From 7ef99ccfe686b42e39929645ec49667c3babc9b3 Mon Sep 17 00:00:00 2001
From: superuserjr <80784472+turbodaemon@users.noreply.github.com>
Date: Mon, 9 Mar 2026 20:17:03 -0400
Subject: [PATCH 01/34] =?UTF-8?q?=E2=99=BB=EF=B8=8F=20refactor(compose):?=
 =?UTF-8?q?=20replace=20CLI=20shelling=20with=20Docker=20Engine=20API?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Rewrite validateComposeConfiguration to parse YAML in-process instead
  of spawning docker compose config
- Rewrite updateContainerWithCompose to use Docker Engine API
  (pullImage + stopAndRemoveContainer + recreateContainer) instead of
  docker compose pull/up
- Delegate executeSelfUpdate to parent orchestrator for health gate and
  rollback safety
- Log deprecation for composeFileOnce batch mode (unavailable without CLI)
- Remove dead code: updateComposeServicesWithCompose, runComposeCommand,
  executeCommand, getContainerRunningState, execFile import, and
  COMPOSE_COMMAND_* constants
- Remove 18 dead tests and clean up spy references to removed methods
---
 .../dockercompose/Dockercompose.test.ts       | 728 ++++++------------
 .../providers/dockercompose/Dockercompose.ts  | 407 ++--------
 2 files changed, 294 insertions(+), 841 deletions(-)

diff --git a/app/triggers/providers/dockercompose/Dockercompose.test.ts b/app/triggers/providers/dockercompose/Dockercompose.test.ts
index fe79d24c..fbcdb16b 100644
--- a/app/triggers/providers/dockercompose/Dockercompose.test.ts
+++ b/app/triggers/providers/dockercompose/Dockercompose.test.ts
@@ -1,4 +1,3 @@
-import { execFile } from 'node:child_process';
 import { EventEmitter } from 'node:events';
 import { watch } from 'node:fs';
 import fs from 'node:fs/promises';
@@ -64,10 +63,6 @@ vi.mock('../../../store/container.js', () => ({
 vi.mock('../../hooks/HookRunner.js', () => ({ runHook: vi.fn() }));
 vi.mock('../docker/HealthMonitor.js', () => ({ startHealthMonitor: vi.fn() }));
 
-vi.mock('node:child_process', () => ({
-  execFile: vi.fn(),
-}));
-
 vi.mock('node:fs', async (importOriginal) => {
   const actual = await importOriginal();
   return {
@@ -209,6 +204,37 @@ function makeExecMocks({
   return { startStream, mockExec, recreatedContainer };
 }
 
+function makeDockerContainerHandle({
+  running = true,
+  image = 'nginx:1.0.0',
+  id = 'container-id',
+  name = 'nginx',
+  autoRemove = false,
+} = {}) {
+  return {
+    id,
+    inspect: vi.fn().mockResolvedValue({
+      Id: id,
+      Name: `/${name}`,
+      Config: {
+        Image: image,
+        Env: [],
+        Labels: {},
+      },
+      HostConfig: {
+        AutoRemove: autoRemove,
+      },
+      NetworkSettings: {
+        Networks: {},
+      },
+      State: { Running: running },
+    }),
+    stop: vi.fn().mockResolvedValue(undefined),
+    remove: vi.fn().mockResolvedValue(undefined),
+    wait: vi.fn().mockResolvedValue(undefined),
+  };
+}
+
 /**
  * Set up the common spies used by processComposeFile tests that exercise
  * the write / trigger / hooks path.
@@ -290,11 +316,23 @@ describe('Dockercompose Trigger', () => {
     mockDockerApi = {
       modem: {
         socketPath: '/var/run/docker.sock',
-      },
-      getContainer: vi.fn().mockReturnValue({
-        inspect: vi.fn().mockResolvedValue({
-          State: { Running: true },
+        followProgress: vi.fn((_stream, onDone, onProgress) => {
+          onProgress?.({
+            status: 'Pulling fs layer',
+            id: 'layer-1',
+            progressDetail: { current: 1, total: 1 },
+          });
+          onDone?.(null, [{ status: 'Pull complete', id: 'layer-1' }]);
         }),
+      },
+      pull: vi.fn().mockResolvedValue({}),
+      createContainer: vi.fn().mockResolvedValue({
+        start: vi.fn().mockResolvedValue(undefined),
+        inspect: vi.fn().mockResolvedValue({ State: { Running: true } }),
+      }),
+      getContainer: vi.fn().mockReturnValue(makeDockerContainerHandle()),
+      getNetwork: vi.fn().mockReturnValue({
+        connect: vi.fn().mockResolvedValue(undefined),
       }),
     };
 
@@ -314,11 +352,6 @@ describe('Dockercompose Trigger', () => {
         },
       },
     });
-
-    execFile.mockImplementation((_command, _args, _options, callback) => {
-      callback(null, '', '');
-      return {};
-    });
   });
 
   // -----------------------------------------------------------------------
@@ -1198,74 +1231,62 @@ describe('Dockercompose Trigger', () => {
   // compose command execution
   // -----------------------------------------------------------------------
 
-  test('updateContainerWithCompose should skip compose commands in dry-run mode', async () => {
+  test('updateContainerWithCompose should skip Docker API calls in dry-run mode', async () => {
     trigger.configuration.dryrun = true;
-    const runComposeCommandSpy = vi.spyOn(trigger, 'runComposeCommand').mockResolvedValue();
-    const container = { name: 'nginx', watcher: 'local' };
+    const pullImageSpy = vi.spyOn(trigger, 'pullImage').mockResolvedValue();
+    const container = makeContainer({ name: 'nginx' });
 
     await trigger.updateContainerWithCompose('/opt/drydock/test/stack.yml', 'nginx', container);
 
-    expect(runComposeCommandSpy).not.toHaveBeenCalled();
+    expect(pullImageSpy).not.toHaveBeenCalled();
     expect(mockLog.child).toHaveBeenCalledWith({ container: 'nginx' });
     expect(mockLog.info).toHaveBeenCalledWith(expect.stringContaining('dry-run mode is enabled'));
   });
 
-  test('updateContainerWithCompose should run pull then up for the target service', async () => {
+  test('updateContainerWithCompose should pull and recreate the target service via Docker API', async () => {
     trigger.configuration.dryrun = false;
-    const runComposeCommandSpy = vi.spyOn(trigger, 'runComposeCommand').mockResolvedValue();
-    mockDockerApi.getContainer.mockReturnValueOnce({
-      inspect: vi.fn().mockResolvedValue({
-        State: { Running: true },
-      }),
-    });
-    const container = { name: 'nginx', watcher: 'local' };
+    const pullImageSpy = vi.spyOn(trigger, 'pullImage').mockResolvedValue();
+    const stopContainerSpy = vi.spyOn(trigger, 'stopContainer').mockResolvedValue();
+    const removeContainerSpy = vi.spyOn(trigger, 'removeContainer').mockResolvedValue();
+    const createContainerSpy = vi.spyOn(trigger, 'createContainer').mockResolvedValue({
+      start: vi.fn().mockResolvedValue(undefined),
+    } as any);
+    const startContainerSpy = vi.spyOn(trigger, 'startContainer').mockResolvedValue();
+    const container = makeContainer({ name: 'nginx' });
 
     await trigger.updateContainerWithCompose('/opt/drydock/test/stack.yml', 'nginx', container);
 
-    expect(runComposeCommandSpy).toHaveBeenNthCalledWith(
-      1,
-      '/opt/drydock/test/stack.yml',
-      ['pull', 'nginx'],
-      mockLog,
-    );
-    expect(runComposeCommandSpy).toHaveBeenNthCalledWith(
-      2,
-      '/opt/drydock/test/stack.yml',
-      ['up', '-d', '--no-deps', 'nginx'],
-      mockLog,
-    );
+    expect(pullImageSpy).toHaveBeenCalledTimes(1);
+    expect(stopContainerSpy).toHaveBeenCalledTimes(1);
+    expect(removeContainerSpy).toHaveBeenCalledTimes(1);
+    expect(createContainerSpy).toHaveBeenCalledTimes(1);
+    expect(startContainerSpy).toHaveBeenCalledTimes(1);
   });
 
   test('updateContainerWithCompose should preserve stopped runtime state', async () => {
     trigger.configuration.dryrun = false;
-    const runComposeCommandSpy = vi.spyOn(trigger, 'runComposeCommand').mockResolvedValue();
-    mockDockerApi.getContainer.mockReturnValueOnce({
-      inspect: vi.fn().mockResolvedValue({
-        State: { Running: false },
+    const pullImageSpy = vi.spyOn(trigger, 'pullImage').mockResolvedValue();
+    const startContainerSpy = vi.spyOn(trigger, 'startContainer').mockResolvedValue();
+    mockDockerApi.getContainer.mockReturnValueOnce(
+      makeDockerContainerHandle({
+        running: false,
       }),
-    });
-    const container = { name: 'nginx', watcher: 'local' };
+    );
+    const container = makeContainer({ name: 'nginx' });
 
     await trigger.updateContainerWithCompose('/opt/drydock/test/stack.yml', 'nginx', container);
 
-    expect(runComposeCommandSpy).toHaveBeenNthCalledWith(
-      1,
-      '/opt/drydock/test/stack.yml',
-      ['pull', 'nginx'],
-      mockLog,
-    );
-    expect(runComposeCommandSpy).toHaveBeenNthCalledWith(
-      2,
-      '/opt/drydock/test/stack.yml',
-      ['up', '--no-start', '--no-deps', 'nginx'],
-      mockLog,
-    );
+    expect(pullImageSpy).toHaveBeenCalledTimes(1);
+    expect(startContainerSpy).not.toHaveBeenCalled();
   });
 
-  test('updateContainerWithCompose should add force-recreate argument when requested', async () => {
+  test('updateContainerWithCompose should skip pull when requested and still recreate', async () => {
     trigger.configuration.dryrun = false;
-    const runComposeCommandSpy = vi.spyOn(trigger, 'runComposeCommand').mockResolvedValue();
-    const container = { name: 'nginx', watcher: 'local' };
+    const pullImageSpy = vi.spyOn(trigger, 'pullImage').mockResolvedValue();
+    const createContainerSpy = vi.spyOn(trigger, 'createContainer').mockResolvedValue({
+      start: vi.fn().mockResolvedValue(undefined),
+    } as any);
+    const container = makeContainer({ name: 'nginx' });
 
     await trigger.updateContainerWithCompose('/opt/drydock/test/stack.yml', 'nginx', container, {
       shouldStart: true,
@@ -1273,18 +1294,14 @@ describe('Dockercompose Trigger', () => {
       forceRecreate: true,
     });
 
-    expect(runComposeCommandSpy).toHaveBeenCalledTimes(1);
-    expect(runComposeCommandSpy).toHaveBeenCalledWith(
-      '/opt/drydock/test/stack.yml',
-      ['up', '-d', '--no-deps', '--force-recreate', 'nginx'],
-      mockLog,
-    );
+    expect(pullImageSpy).not.toHaveBeenCalled();
+    expect(createContainerSpy).toHaveBeenCalledTimes(1);
   });
 
-  test('updateContainerWithCompose should pass compose file chain to compose commands', async () => {
+  test('updateContainerWithCompose should ignore compose file chain and use Docker API path', async () => {
     trigger.configuration.dryrun = false;
-    const runComposeCommandSpy = vi.spyOn(trigger, 'runComposeCommand').mockResolvedValue();
-    const container = { name: 'nginx', watcher: 'local' };
+    const pullImageSpy = vi.spyOn(trigger, 'pullImage').mockResolvedValue();
+    const container = makeContainer({ name: 'nginx' });
     const composeFiles = ['/opt/drydock/test/stack.yml', '/opt/drydock/test/stack.override.yml'];
 
     await trigger.updateContainerWithCompose('/opt/drydock/test/stack.yml', 'nginx', container, {
@@ -1293,11 +1310,18 @@ describe('Dockercompose Trigger', () => {
       composeFiles,
     });
 
-    expect(runComposeCommandSpy).toHaveBeenCalledWith(
-      '/opt/drydock/test/stack.yml',
-      ['up', '-d', '--no-deps', 'nginx'],
-      mockLog,
-      composeFiles,
+    expect(pullImageSpy).not.toHaveBeenCalled();
+  });
+
+  test('updateContainerWithCompose should throw when current container cannot be resolved', async () => {
+    trigger.configuration.dryrun = false;
+    const container = makeContainer({ name: 'nginx' });
+    vi.spyOn(trigger, 'getCurrentContainer').mockResolvedValue(undefined);
+
+    await expect(
+      trigger.updateContainerWithCompose('/opt/drydock/test/stack.yml', 'nginx', container),
+    ).rejects.toThrow(
+      'Unable to refresh compose service nginx from /opt/drydock/test/stack.yml because container nginx no longer exists',
     );
   });
 
@@ -1393,7 +1417,7 @@ describe('Dockercompose Trigger', () => {
     expect(resolveContextSpy).toHaveBeenCalledWith(container, 'nginx:1.0.0');
   });
 
-  test('recreateContainer integration should update compose image and run force-recreate without pull', async () => {
+  test('recreateContainer integration should update compose image and recreate via Docker API without pull', async () => {
     trigger.configuration.dryrun = false;
     const container = makeContainer({
       name: 'nginx',
@@ -1408,7 +1432,10 @@ describe('Dockercompose Trigger', () => {
     vi.spyOn(trigger, 'getComposeFileAsObject').mockResolvedValue(
       makeCompose({ nginx: { image: 'nginx:1.1.0' } }),
     );
-    const runComposeCommandSpy = vi.spyOn(trigger, 'runComposeCommand').mockResolvedValue();
+    const pullImageSpy = vi.spyOn(trigger, 'pullImage').mockResolvedValue();
+    const createContainerSpy = vi.spyOn(trigger, 'createContainer').mockResolvedValue({
+      start: vi.fn().mockResolvedValue(undefined),
+    } as any);
 
     await trigger.recreateContainer(
       mockDockerApi,
@@ -1425,15 +1452,11 @@ describe('Dockercompose Trigger', () => {
       '/opt/drydock/test/stack.yml',
       expect.stringContaining('nginx:1.0.0'),
     );
-    expect(runComposeCommandSpy).toHaveBeenCalledTimes(1);
-    expect(runComposeCommandSpy).toHaveBeenCalledWith(
-      '/opt/drydock/test/stack.yml',
-      ['up', '-d', '--no-deps', '--force-recreate', 'nginx'],
-      mockLog,
-    );
+    expect(pullImageSpy).not.toHaveBeenCalled();
+    expect(createContainerSpy).toHaveBeenCalledTimes(1);
   });
 
-  test('executeSelfUpdate should run compose-native self-update strategy', async () => {
+  test('executeSelfUpdate should delegate to parent self-update transition with hydrated runtime context', async () => {
     trigger.configuration.dryrun = false;
     const container = makeContainer({
       name: 'drydock',
@@ -1448,8 +1471,25 @@ describe('Dockercompose Trigger', () => {
       service: 'drydock',
       serviceDefinition: {},
     };
+    const currentContainer = makeDockerContainerHandle();
+    const currentContainerSpec = {
+      Id: 'current-id',
+      Name: '/drydock',
+      State: { Running: true },
+      HostConfig: {
+        Binds: ['/var/run/docker.sock:/var/run/docker.sock'],
+      },
+    };
 
-    const insertBackupSpy = vi.spyOn(trigger, 'insertContainerImageBackup');
+    const getCurrentContainerSpy = vi
+      .spyOn(trigger, 'getCurrentContainer')
+      .mockResolvedValue(currentContainer);
+    const inspectContainerSpy = vi
+      .spyOn(trigger, 'inspectContainer')
+      .mockResolvedValue(currentContainerSpec as any);
+    const orchestratorExecuteSpy = vi
+      .spyOn(trigger.selfUpdateOrchestrator, 'execute')
+      .mockResolvedValue(true);
     const composeUpdateSpy = vi.spyOn(trigger, 'updateContainerWithCompose').mockResolvedValue();
     const hooksSpy = vi.spyOn(trigger, 'runServicePostStartHooks').mockResolvedValue();
 
@@ -1469,13 +1509,19 @@ describe('Dockercompose Trigger', () => {
     );
 
     expect(updated).toBe(true);
-    expect(insertBackupSpy).toHaveBeenCalledTimes(1);
-    expect(composeUpdateSpy).toHaveBeenCalledWith(
-      '/opt/drydock/test/stack.yml',
-      'drydock',
+    expect(getCurrentContainerSpy).toHaveBeenCalledWith(mockDockerApi, container);
+    expect(inspectContainerSpy).toHaveBeenCalledWith(currentContainer, mockLog);
+    expect(orchestratorExecuteSpy).toHaveBeenCalledWith(
+      expect.objectContaining({
+        currentContainer,
+        currentContainerSpec,
+      }),
       container,
+      mockLog,
+      undefined,
     );
-    expect(hooksSpy).toHaveBeenCalledWith(container, 'drydock', {});
+    expect(composeUpdateSpy).not.toHaveBeenCalled();
+    expect(hooksSpy).not.toHaveBeenCalled();
   });
 
   test('performContainerUpdate should throw when compose context is missing', async () => {
@@ -1517,6 +1563,12 @@ describe('Dockercompose Trigger', () => {
     };
     const composeUpdateSpy = vi.spyOn(trigger, 'updateContainerWithCompose').mockResolvedValue();
     const hooksSpy = vi.spyOn(trigger, 'runServicePostStartHooks').mockResolvedValue();
+    const getCurrentContainerSpy = vi
+      .spyOn(trigger, 'getCurrentContainer')
+      .mockResolvedValue(makeDockerContainerHandle());
+    const orchestratorExecuteSpy = vi
+      .spyOn(trigger.selfUpdateOrchestrator, 'execute')
+      .mockResolvedValue(true);
 
     const updated = await trigger.executeSelfUpdate(
       {
@@ -1538,77 +1590,13 @@ describe('Dockercompose Trigger', () => {
     expect(updated).toBe(false);
     expect(composeUpdateSpy).not.toHaveBeenCalled();
     expect(hooksSpy).not.toHaveBeenCalled();
+    expect(getCurrentContainerSpy).not.toHaveBeenCalled();
+    expect(orchestratorExecuteSpy).not.toHaveBeenCalled();
     expect(mockLog.info).toHaveBeenCalledWith(
       'Do not replace the existing container because dry-run mode is enabled',
     );
   });
 
-  test('runComposeCommand should use docker compose when available', async () => {
-    const logContainer = { debug: vi.fn(), warn: vi.fn() };
-    const composeFilePath = path.resolve(process.cwd(), 'test', 'stack.yml');
-
-    await trigger.runComposeCommand(composeFilePath, ['pull', 'nginx'], logContainer);
-
-    expect(execFile).toHaveBeenCalledWith(
-      'docker',
-      ['compose', '-f', composeFilePath, 'pull', 'nginx'],
-      expect.objectContaining({
-        cwd: path.dirname(composeFilePath),
-      }),
-      expect.any(Function),
-    );
-    expect(logContainer.warn).not.toHaveBeenCalled();
-  });
-
-  test('runComposeCommand should include ordered compose file chain when provided', async () => {
-    const logContainer = { debug: vi.fn(), warn: vi.fn() };
-    const composeFilePath = path.resolve(process.cwd(), 'test', 'stack.yml');
-    const composeOverridePath = path.resolve(process.cwd(), 'test', 'stack.override.yml');
-
-    await trigger.runComposeCommand(composeFilePath, ['pull', 'nginx'], logContainer, [
-      composeFilePath,
-      composeOverridePath,
-    ]);
-
-    expect(execFile).toHaveBeenCalledWith(
-      'docker',
-      ['compose', '-f', composeFilePath, '-f', composeOverridePath, 'pull', 'nginx'],
-      expect.objectContaining({
-        cwd: path.dirname(composeFilePath),
-      }),
-      expect.any(Function),
-    );
-  });
-
-  test('runComposeCommand should not forward non-allowlisted parent environment variables', async () => {
-    const secretKey = 'DRYDOCK_TEST_COMPOSE_SECRET';
-    const originalSecret = process.env[secretKey];
-    const originalPath = process.env.PATH;
-    process.env[secretKey] = 'top-secret';
-    process.env.PATH = '/tmp/drydock-compose-path';
-    const composeFilePath = path.resolve(process.cwd(), 'test', 'stack.yml');
-
-    try {
-      const logContainer = { debug: vi.fn(), warn: vi.fn() };
-      await trigger.runComposeCommand(composeFilePath, ['pull', 'nginx'], logContainer);
-
-      const commandOptions = execFile.mock.calls[0][2];
-      expect(commandOptions.env.PATH).toBe('/tmp/drydock-compose-path');
-      expect(commandOptions.env[secretKey]).toBeUndefined();
-    } finally {
-      if (originalSecret === undefined) {
-        delete process.env[secretKey];
-      } else {
-        process.env[secretKey] = originalSecret;
-      }
-      if (originalPath === undefined) {
-        delete process.env.PATH;
-      } else {
-        process.env.PATH = originalPath;
-      }
-    }
-  });
-
   test('resolveComposeFilePath should allow absolute compose files while blocking relative traversal when boundary is enforced', () => {
     const composeFilePathOutsideWorkingDirectory = path.resolve(
       process.cwd(),
@@ -1637,187 +1625,6 @@ describe('Dockercompose Trigger', () => {
     ).not.toThrow();
   });
 
-  test('runComposeCommand should fall back to docker-compose when docker compose plugin is missing', async () => {
-    execFile
-      .mockImplementationOnce((_command, _args, _options, callback) => {
-        const error = new Error('compose plugin missing');
-        error.stderr = "docker: 'compose' is not a docker command.";
-        callback(error, '', error.stderr);
-        return {};
-      })
-      .mockImplementationOnce((_command, _args, _options, callback) => {
-        callback(null, '', '');
-        return {};
-      });
-
-    const logContainer = { debug: vi.fn(), warn: vi.fn() };
-    const composeFilePath = path.resolve(process.cwd(), 'test', 'stack.yml');
-
-    await trigger.runComposeCommand(composeFilePath, ['pull', 'nginx'], logContainer);
-
-    expect(execFile).toHaveBeenNthCalledWith(
-      1,
-      'docker',
-      ['compose', '-f', composeFilePath, 'pull', 'nginx'],
-      expect.objectContaining({ cwd: path.dirname(composeFilePath) }),
-      expect.any(Function),
-    );
-    expect(execFile).toHaveBeenNthCalledWith(
-      2,
-      'docker-compose',
-      ['-f', composeFilePath, 'pull', 'nginx'],
-      expect.objectContaining({ cwd: path.dirname(composeFilePath) }),
-      expect.any(Function),
-    );
-    expect(logContainer.warn).toHaveBeenCalledWith(
-      expect.stringContaining('trying docker-compose'),
-    );
-  });
-
-  test('runComposeCommand should accept compose files outside the working directory', async () => {
-    execFile.mockImplementationOnce((_command, _args, _options, callback) => {
-      callback(null, '', '');
-      return {};
-    });
-
-    const logContainer = { debug: vi.fn(), warn: vi.fn() };
-    const composeFilePath = path.resolve(process.cwd(), '..', 'external', 'compose.yaml');
-
-    await trigger.runComposeCommand(composeFilePath, ['up', '-d'], logContainer);
-
-    expect(execFile).toHaveBeenCalledWith(
-      'docker',
-      ['compose', '-f', composeFilePath, 'up', '-d'],
-      expect.objectContaining({ cwd: path.dirname(composeFilePath) }),
-      expect.any(Function),
-    );
-  });
-
-  test('runComposeCommand should throw when compose command fails', async () => {
-    execFile.mockImplementationOnce((_command, _args, _options, callback) => {
-      callback(new Error('boom'), '', 'boom');
-      return {};
-    });
-
-    const logContainer = { debug: vi.fn(), warn: vi.fn() };
-    const composeFilePath = path.resolve(process.cwd(), 'test', 'stack.yml');
-
-    await expect(
-      trigger.runComposeCommand(composeFilePath, ['pull', 'nginx'], logContainer),
-    ).rejects.toThrow(`Error when running docker compose pull nginx for ${composeFilePath} (boom)`);
-
-    expect(execFile).toHaveBeenCalledTimes(1);
-  });
-
-  test('runComposeCommand should handle failures without stderr payload', async () => {
-    execFile.mockImplementationOnce((_command, _args, _options, callback) => {
-      callback(new Error('boom-without-stderr'), '', undefined);
-      return {};
-    });
-
-    const logContainer = { debug: vi.fn(), warn: vi.fn() };
-    const composeFilePath = path.resolve(process.cwd(), 'test', 'stack.yml');
-
-    await expect(
-      trigger.runComposeCommand(composeFilePath, ['pull', 'nginx'], logContainer),
-    ).rejects.toThrow(
-      `Error when running docker compose pull nginx for ${composeFilePath} (boom-without-stderr)`,
-    );
-  });
-
-  test('runComposeCommand should log stdout and stderr output', async () => {
-    execFile.mockImplementationOnce((_command, _args, _options, callback) => {
-      callback(null, 'pulled image\n', 'minor warning\n');
-      return {};
-    });
-    const logContainer = { debug: vi.fn(), warn: vi.fn() };
-    const composeFilePath = path.resolve(process.cwd(), 'test', 'stack.yml');
-
-    await trigger.runComposeCommand(composeFilePath, ['pull', 'nginx'], logContainer);
-
-    expect(logContainer.debug).toHaveBeenCalledWith(
-      expect.stringContaining('docker compose pull nginx stdout:\npulled image'),
-    );
-    expect(logContainer.debug).toHaveBeenCalledWith(
-      expect.stringContaining('docker compose pull nginx stderr:\nminor warning'),
-    );
-  });
-
-  test('runComposeCommand should resolve relative compose file paths outside working directory', async () => {
-    execFile.mockImplementationOnce((_command, _args, _options, callback) => {
-      callback(null, '', '');
-      return {};
-    });
-
-    const logContainer = { debug: vi.fn(), warn: vi.fn() };
-    const expectedPath = path.resolve(process.cwd(), '../outside/stack.yml');
-
-    await trigger.runComposeCommand('../outside/stack.yml', ['pull', 'nginx'], logContainer);
-
-    expect(execFile).toHaveBeenCalledWith(
-      'docker',
-      ['compose', '-f', expectedPath, 'pull', 'nginx'],
-      expect.objectContaining({ cwd: path.dirname(expectedPath) }),
-      expect.any(Function),
-    );
-  });
-
-  test('getContainerRunningState should assume running when inspect fails', async () => {
-    const logContainer = { warn: vi.fn() };
-    mockDockerApi.getContainer.mockReturnValueOnce({
-      inspect: vi.fn().mockRejectedValue(new Error('inspect failed')),
-    });
-
-    const running = await trigger.getContainerRunningState(
-      {
-        name: 'nginx',
-        watcher: 'local',
-      },
-      logContainer,
-    );
-
-    expect(running).toBe(true);
-    expect(logContainer.warn).toHaveBeenCalledWith(
-      'Unable to inspect running state for nginx; assuming running (inspect failed)',
-    );
-  });
-
-  test('getContainerRunningState should assume running when watcher dockerApi is unavailable', async () => {
-    const logContainer = { warn: vi.fn() };
-
-    const running = await trigger.getContainerRunningState(
-      {
-        name: 'nginx',
-        watcher: 'missing',
-      },
-      logContainer,
-    );
-
-    expect(running).toBe(true);
-  });
-
-  test('getContainerRunningState should assume running when watcher dockerApi is not an object', async () => {
-    const logContainer = { warn: vi.fn() };
-    getState.mockReturnValue({
-      registry: getState().registry,
-      watcher: {
-        'docker.local': {
-          dockerApi: 'invalid',
-        },
-      },
-    });
-
-    const running = await trigger.getContainerRunningState(
-      {
-        name: 'nginx',
-        watcher: 'local',
-      },
-      logContainer,
-    );
-
-    expect(running).toBe(true);
-  });
-
   test('resolveComposeServiceContext should throw when no compose file is configured', async () => {
     trigger.configuration.file = undefined;
 
@@ -2582,43 +2389,17 @@ describe('Dockercompose Trigger', () => {
     expect(writeSpy).not.toHaveBeenCalled();
   });
 
-  test('validateComposeConfiguration should fall back to docker-compose when docker compose plugin is missing', async () => {
-    const executeCommandSpy = vi
-      .spyOn(trigger, 'executeCommand')
-      .mockRejectedValueOnce(
-        Object.assign(new Error('compose plugin missing'), {
-          stderr: "docker: 'compose' is not a docker command.",
-        }),
-      )
-      .mockResolvedValueOnce({ stdout: '', stderr: '' });
-
+  test('validateComposeConfiguration should validate compose text in-process without shell commands', async () => {
     await trigger.validateComposeConfiguration(
       '/opt/drydock/test/compose.yml',
       'services:\n  nginx:\n    image: nginx:1.1.0\n',
     );
-
-    expect(executeCommandSpy).toHaveBeenNthCalledWith(
-      1,
-      'docker',
-      ['compose', '-f', expect.stringContaining('.compose.yml.validate-'), 'config', '--quiet'],
-      expect.objectContaining({
-        cwd: '/opt/drydock/test',
-      }),
-    );
-    expect(executeCommandSpy).toHaveBeenNthCalledWith(
-      2,
-      'docker-compose',
-      ['-f', expect.stringContaining('.compose.yml.validate-'), 'config', '--quiet'],
-      expect.objectContaining({
-        cwd: '/opt/drydock/test',
-      }),
-    );
   });
 
   test('validateComposeConfiguration should validate updated file against full compose file chain', async () => {
-    const executeCommandSpy = vi
-      .spyOn(trigger, 'executeCommand')
-      .mockResolvedValueOnce({ stdout: '', stderr: '' });
+    const getComposeFileAsObjectSpy = vi
+      .spyOn(trigger, 'getComposeFileAsObject')
+      .mockResolvedValue(makeCompose({ base: { image: 'busybox:1.0.0' } }));
 
     await trigger.validateComposeConfiguration(
       '/opt/drydock/test/stack.override.yml',
@@ -2628,21 +2409,7 @@ describe('Dockercompose Trigger', () => {
       },
     );
 
-    expect(executeCommandSpy).toHaveBeenCalledWith(
-      'docker',
-      [
-        'compose',
-        '-f',
-        '/opt/drydock/test/stack.yml',
-        '-f',
-        expect.stringContaining('.stack.override.yml.validate-'),
-        'config',
-        '--quiet',
-      ],
-      expect.objectContaining({
-        cwd: '/opt/drydock/test',
-      }),
-    );
+    expect(getComposeFileAsObjectSpy).toHaveBeenCalledWith('/opt/drydock/test/stack.yml');
   });
 
   test('updateComposeServiceImageInText should throw when compose document has parse errors', () => {
@@ -3583,7 +3350,7 @@ describe('Dockercompose Trigger', () => {
     expect(parseDocumentSpy).toHaveBeenCalledTimes(1);
   });
 
-  test('processComposeFile should batch compose pull/up by file when composeFileOnce mode is enabled', async () => {
+  test('processComposeFile should skip compose-file-once batching in Docker Engine API mode', async () => {
     trigger.configuration.dryrun = false;
     trigger.configuration.prune = false;
     trigger.configuration.composeFileOnce = true;
@@ -3618,7 +3385,9 @@ describe('Dockercompose Trigger', () => {
       ),
     );
     vi.spyOn(trigger, 'writeComposeFile').mockResolvedValue();
-    const runComposeCommandSpy = vi.spyOn(trigger, 'runComposeCommand').mockResolvedValue();
+    const runContainerUpdateLifecycleSpy = vi
+      .spyOn(trigger, 'runContainerUpdateLifecycle')
+      .mockResolvedValue();
     vi.spyOn(trigger, 'maybeScanAndGateUpdate').mockResolvedValue();
     vi.spyOn(trigger, 'runPreUpdateHook').mockResolvedValue();
     vi.spyOn(trigger, 'runPostUpdateHook').mockResolvedValue();
@@ -3630,18 +3399,9 @@ describe('Dockercompose Trigger', () => {
       redisContainer,
     ]);
 
-    expect(runComposeCommandSpy).toHaveBeenCalledTimes(2);
-    expect(runComposeCommandSpy).toHaveBeenNthCalledWith(
-      1,
-      '/opt/drydock/test/stack.yml',
-      ['pull', 'nginx', 'redis'],
-      expect.anything(),
-    );
-    expect(runComposeCommandSpy).toHaveBeenNthCalledWith(
-      2,
-      '/opt/drydock/test/stack.yml',
-      ['up', '-d', '--no-deps', 'nginx', 'redis'],
-      expect.anything(),
+    expect(runContainerUpdateLifecycleSpy).toHaveBeenCalledTimes(2);
+    expect(mockLog.info).toHaveBeenCalledWith(
+      expect.stringContaining('can be re-implemented via Docker Engine API later'),
     );
   });
 
@@ -4464,91 +4224,15 @@ describe('Dockercompose Trigger', () => {
     expect(composeFile).toBe('/opt/drydock/test/stack.yml');
   });
 
-  test('validateComposeConfiguration should throw a compose-command error for non-fallback failures', async () => {
-    vi.spyOn(trigger, 'executeCommand').mockRejectedValueOnce(new Error('invalid compose file'));
-
+  test('validateComposeConfiguration should throw when the updated compose text is invalid YAML', async () => {
     await expect(
       trigger.validateComposeConfiguration(
         '/opt/drydock/test/compose.yml',
-        'services:\n  nginx:\n    image: nginx:broken\n',
+        'services:\n  nginx: [\n',
       ),
     ).rejects.toThrow('Error when validating compose configuration');
   });
 
-  test('updateComposeServicesWithCompose should return immediately when no services are provided', async () => {
-    const runComposeCommandSpy = vi.spyOn(trigger, 'runComposeCommand').mockResolvedValue();
-
-    await trigger.updateComposeServicesWithCompose('/opt/drydock/test/stack.yml', []);
-
-    expect(runComposeCommandSpy).not.toHaveBeenCalled();
-  });
-
-  test('updateComposeServicesWithCompose should no-op in dry-run mode', async () => {
-    trigger.configuration.dryrun = true;
-    const runComposeCommandSpy = vi.spyOn(trigger, 'runComposeCommand').mockResolvedValue();
-
-    await trigger.updateComposeServicesWithCompose('/opt/drydock/test/stack.yml', ['nginx']);
-
-    expect(runComposeCommandSpy).not.toHaveBeenCalled();
-    expect(mockLog.info).toHaveBeenCalledWith(expect.stringContaining('dry-run mode is enabled'));
-  });
-
-  test('updateComposeServicesWithCompose should run chain-aware pull/up for started and stopped services', async () => {
-    trigger.configuration.dryrun = false;
-    const runComposeCommandSpy = vi.spyOn(trigger, 'runComposeCommand').mockResolvedValue();
-    const composeFiles = ['/opt/drydock/test/stack.yml', '/opt/drydock/test/stack.override.yml'];
-
-    await trigger.updateComposeServicesWithCompose(
-      '/opt/drydock/test/stack.yml',
-      ['nginx', 'redis'],
-      {
-        composeFiles,
-        serviceRunningStates: new Map<string, boolean>([
-          ['nginx', true],
-          ['redis', false],
-        ]),
-      },
-    );
-
-    expect(runComposeCommandSpy).toHaveBeenNthCalledWith(
-      1,
-      '/opt/drydock/test/stack.yml',
-      ['pull', 'nginx', 'redis'],
-      expect.anything(),
-      composeFiles,
-    );
-    expect(runComposeCommandSpy).toHaveBeenNthCalledWith(
-      2,
-      '/opt/drydock/test/stack.yml',
-      ['up', '-d', '--no-deps', 'nginx'],
-      expect.anything(),
-      composeFiles,
-    );
-    expect(runComposeCommandSpy).toHaveBeenNthCalledWith(
-      3,
-      '/opt/drydock/test/stack.yml',
-      ['up', '--no-start', '--no-deps', 'redis'],
-      expect.anything(),
-      composeFiles,
-    );
-  });
-
-  test('updateComposeServicesWithCompose should keep stopped services stopped without compose-file chain', async () => {
-    trigger.configuration.dryrun = false;
-    const runComposeCommandSpy = vi.spyOn(trigger, 'runComposeCommand').mockResolvedValue();
-
-    await trigger.updateComposeServicesWithCompose('/opt/drydock/test/stack.yml', ['nginx'], {
-      serviceRunningStates: new Map<string, boolean>([['nginx', false]]),
-    });
-
-    expect(runComposeCommandSpy).toHaveBeenNthCalledWith(
-      2,
-      '/opt/drydock/test/stack.yml',
-      ['up', '--no-start', '--no-deps', 'nginx'],
-      expect.anything(),
-    );
-  });
-
   test('mutateComposeFile should validate compose chain when multiple compose files are provided', async () => {
     vi.spyOn(trigger, 'getComposeFile').mockResolvedValue(
       Buffer.from('services:\n  nginx:\n    image: nginx:1.0.0\n'),
@@ -4606,16 +4290,52 @@ describe('Dockercompose Trigger', () => {
     );
   });
 
-  test('executeSelfUpdate should pass compose chain to compose refresh when multiple files are present', async () => {
+  test('performContainerUpdate should skip per-service refresh when compose-file-once is already applied', async () => {
+    trigger.configuration.dryrun = false;
+    const container = makeContainer({
+      name: 'nginx',
+    });
+    const updateContainerWithComposeSpy = vi
+      .spyOn(trigger, 'updateContainerWithCompose')
+      .mockResolvedValue();
+    const hooksSpy = vi.spyOn(trigger, 'runServicePostStartHooks').mockResolvedValue();
+
+    const updated = await trigger.performContainerUpdate({} as any, container as any, mockLog, {
+      composeFile: '/opt/drydock/test/stack.yml',
+      service: 'nginx',
+      serviceDefinition: {},
+      composeFileOnceApplied: true,
+    } as any);
+
+    expect(updated).toBe(true);
+    expect(updateContainerWithComposeSpy).not.toHaveBeenCalled();
+    expect(hooksSpy).toHaveBeenCalledWith(container, 'nginx', {});
+    expect(mockLog.info).toHaveBeenCalledWith(
+      expect.stringContaining('Skip per-service compose refresh for nginx'),
+    );
+  });
+
+  test('executeSelfUpdate should forward operation id to parent self-update transition', async () => {
     trigger.configuration.dryrun = false;
     const container = makeContainer({
       name: 'drydock',
       imageName: 'codeswhat/drydock',
     });
+    const currentContainer = makeDockerContainerHandle();
+    const currentContainerSpec = {
+      Id: 'current-id',
+      Name: '/drydock',
+      State: { Running: true },
+      HostConfig: {
+        Binds: ['/var/run/docker.sock:/var/run/docker.sock'],
+      },
+    };
+    vi.spyOn(trigger, 'getCurrentContainer').mockResolvedValue(currentContainer);
+    vi.spyOn(trigger, 'inspectContainer').mockResolvedValue(currentContainerSpec as any);
+    const executeSpy = vi.spyOn(trigger.selfUpdateOrchestrator, 'execute').mockResolvedValue(true);
     const updateContainerWithComposeSpy = vi
       .spyOn(trigger, 'updateContainerWithCompose')
       .mockResolvedValue();
-    vi.spyOn(trigger, 'runServicePostStartHooks').mockResolvedValue();
 
     const updated = await trigger.executeSelfUpdate(
       {
@@ -4628,7 +4348,7 @@ describe('Dockercompose Trigger', () => {
       },
       container,
       mockLog,
-      undefined,
+      'op-self-update-123',
       {
         composeFile: '/opt/drydock/test/stack.override.yml',
         composeFiles: ['/opt/drydock/test/stack.yml', '/opt/drydock/test/stack.override.yml'],
@@ -4638,17 +4358,19 @@ describe('Dockercompose Trigger', () => {
     );
 
     expect(updated).toBe(true);
-    expect(updateContainerWithComposeSpy).toHaveBeenCalledWith(
-      '/opt/drydock/test/stack.override.yml',
-      'drydock',
+    expect(executeSpy).toHaveBeenCalledWith(
+      expect.objectContaining({
+        currentContainer,
+        currentContainerSpec,
+      }),
       container,
-      {
-        composeFiles: ['/opt/drydock/test/stack.yml', '/opt/drydock/test/stack.override.yml'],
-      },
+      mockLog,
+      'op-self-update-123',
     );
+    expect(updateContainerWithComposeSpy).not.toHaveBeenCalled();
   });
 
-  test('processComposeFile should fetch running state once per service in compose-file-once mode', async () => {
+  test('processComposeFile should bypass running-state batching in compose-file-once mode for Docker Engine API runtime', async () => {
     trigger.configuration.dryrun = false;
     trigger.configuration.composeFileOnce = true;
     const firstContainer = makeContainer({
@@ -4669,16 +4391,16 @@ describe('Dockercompose Trigger', () => {
       Buffer.from(['services:', '  nginx:', '    image: nginx:1.0.0', ''].join('\n')),
     );
     vi.spyOn(trigger, 'writeComposeFile').mockResolvedValue();
-    const runningStateSpy = vi.spyOn(trigger, 'getContainerRunningState').mockResolvedValue(true);
-    vi.spyOn(trigger, 'runComposeCommand').mockResolvedValue();
-    vi.spyOn(trigger, 'runContainerUpdateLifecycle').mockResolvedValue();
+    const runContainerUpdateLifecycleSpy = vi
+      .spyOn(trigger, 'runContainerUpdateLifecycle')
+      .mockResolvedValue();
 
     await trigger.processComposeFile('/opt/drydock/test/stack.yml', [
       firstContainer,
       secondContainer,
     ]);
 
-    expect(runningStateSpy).toHaveBeenCalledTimes(1);
+    expect(runContainerUpdateLifecycleSpy).toHaveBeenCalledTimes(2);
   });
 
   test('preview should passthrough base preview errors without compose metadata', async () => {
@@ -4758,9 +4480,9 @@ describe('Dockercompose Trigger', () => {
     }
   });
 
-  test('updateContainerWithCompose should pass compose file chain to pull command', async () => {
+  test('updateContainerWithCompose should use Docker API pull regardless of compose file chain', async () => {
     trigger.configuration.dryrun = false;
-    const runComposeCommandSpy = vi.spyOn(trigger, 'runComposeCommand').mockResolvedValue();
+    const pullImageSpy = vi.spyOn(trigger, 'pullImage').mockResolvedValue();
     const composeFiles = ['/opt/drydock/test/stack.yml', '/opt/drydock/test/stack.override.yml'];
     const container = makeContainer({
       name: 'nginx',
@@ -4772,13 +4494,7 @@ describe('Dockercompose Trigger', () => {
       skipPull: false,
     });
 
-    expect(runComposeCommandSpy).toHaveBeenNthCalledWith(
-      1,
-      '/opt/drydock/test/stack.yml',
-      ['pull', 'nginx'],
-      expect.anything(),
-      composeFiles,
-    );
+    expect(pullImageSpy).toHaveBeenCalledTimes(1);
   });
 
   test('recreateContainer should include compose file chain when compose service is defined in overrides', async () => {
@@ -4834,9 +4550,9 @@ describe('Dockercompose Trigger', () => {
   });
 
   test('validateComposeConfiguration should append target compose file when compose chain omits it', async () => {
-    const executeCommandSpy = vi
-      .spyOn(trigger, 'executeCommand')
-      .mockResolvedValueOnce({ stdout: '', stderr: '' });
+    const getComposeFileAsObjectSpy = vi
+      .spyOn(trigger, 'getComposeFileAsObject')
+      .mockResolvedValue(makeCompose({ base: { image: 'busybox:1.0.0' } }));
 
     await trigger.validateComposeConfiguration(
       '/opt/drydock/test/stack.override.yml',
@@ -4846,20 +4562,6 @@ describe('Dockercompose Trigger', () => {
       },
     );
 
-    expect(executeCommandSpy).toHaveBeenCalledWith(
-      'docker',
-      [
-        'compose',
-        '-f',
-        '/opt/drydock/test/stack.yml',
-        '-f',
-        expect.stringContaining('.stack.override.yml.validate-'),
-        'config',
-        '--quiet',
-      ],
-      expect.objectContaining({
-        cwd: '/opt/drydock/test',
-      }),
-    );
+    expect(getComposeFileAsObjectSpy).toHaveBeenCalledWith('/opt/drydock/test/stack.yml');
   });
 });
diff --git a/app/triggers/providers/dockercompose/Dockercompose.ts b/app/triggers/providers/dockercompose/Dockercompose.ts
index 95959772..6c19f6b4 100644
--- a/app/triggers/providers/dockercompose/Dockercompose.ts
+++ b/app/triggers/providers/dockercompose/Dockercompose.ts
@@ -1,18 +1,14 @@
-import { execFile } from 'node:child_process';
 import { constants as fsConstants } from 'node:fs';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import yaml, { type Pair, type ParsedNode } from 'yaml';
 import type { ContainerImage } from '../../../model/container.js';
 import { getState } from '../../../registry/index.js';
-import { buildComposeCommandEnvironment } from '../../../runtime/child-process-env.js';
 import { resolveConfiguredPath, resolveConfiguredPathWithinBase } from '../../../runtime/paths.js';
 import { sleep } from '../../../util/sleep.js';
 import Docker from '../docker/Docker.js';
 import ComposeFileLockManager from './ComposeFileLockManager.js';
 
-const COMPOSE_COMMAND_TIMEOUT_MS = 60_000;
-const COMPOSE_COMMAND_MAX_BUFFER_BYTES = 10 * 1024 * 1024;
 const YAML_MAX_ALIAS_COUNT = 10_000;
 const COMPOSE_RENAME_MAX_RETRIES = 5;
 const COMPOSE_RENAME_RETRY_MS = 200;
@@ -1084,148 +1080,25 @@ class Dockercompose extends Docker {
     const effectiveComposeFileChain = composeFileChain.includes(composeFilePath)
       ? composeFileChain
       : [...composeFileChain, composeFilePath];
-
-    const composeDirectory = path.dirname(composeFilePath);
-    const composeFileName = path.basename(composeFilePath);
-    const validationFilePath = path.join(
-      composeDirectory,
-      `.${composeFileName}.validate-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`,
-    );
-
-    await fs.writeFile(validationFilePath, composeFileText);
-    const validationArguments = [
-      ...effectiveComposeFileChain.flatMap((composeFile) => [
-        '-f',
-        composeFile === composeFilePath ? validationFilePath : composeFile,
-      ]),
-      'config',
-      '--quiet',
-    ];
-    const commandsToTry = [
-      {
-        command: 'docker',
-        args: ['compose', ...validationArguments],
-        label: 'docker compose',
-      },
-      {
-        command: 'docker-compose',
-        args: validationArguments,
-        label: 'docker-compose',
-      },
-    ];
-
     try {
-      for (const composeCommand of commandsToTry) {
-        try {
-          await this.executeCommand(composeCommand.command, composeCommand.args, {
-            cwd: composeDirectory,
-            env: buildComposeCommandEnvironment(),
-          });
-          return;
-        } catch (e) {
-          const stderr = `${e?.stderr || ''}`;
-          const dockerComposePluginMissing =
-            composeCommand.command === 'docker' &&
-            /docker: ['"]?compose['"]? is not a docker command/i.test(stderr);
-          const executableMissing = e?.code === 'ENOENT';
-
-          if (
-            composeCommand.command === 'docker' &&
-            (dockerComposePluginMissing || executableMissing)
-          ) {
-            this.log.warn(
-              `Cannot use docker compose for compose validation on ${composeFilePath} (${e.message}); trying docker-compose`,
-            );
-            continue;
-          }
-
-          throw new Error(
-            `Error when validating compose configuration for ${composeFilePath} using ${composeCommand.label} (${e.message})`,
+      const composeByFile = new Map<string, unknown>();
+      for (const composeFile of effectiveComposeFileChain) {
+        if (composeFile === composeFilePath) {
+          composeByFile.set(
+            composeFile,
+            yaml.parse(composeFileText, {
+              maxAliasCount: YAML_MAX_ALIAS_COUNT,
+            }),
           );
+          continue;
         }
+        composeByFile.set(composeFile, await this.getComposeFileAsObject(composeFile));
       }
-    } finally {
-      await this.cleanupComposeTemporaryFile(validationFilePath);
-    }
-  }
-
-  async updateComposeServicesWithCompose(composeFile, services, options = {}) {
-    if (services.length === 0) {
-      return;
-    }
-
-    const { composeFiles = [composeFile], serviceRunningStates = new Map<string, boolean>() } =
-      options as {
-        composeFiles?: string[];
-        serviceRunningStates?: Map<string, boolean>;
-      };
-    const composeFileChain = this.normalizeComposeFileChain(composeFile, composeFiles);
-    const runWithComposeFileChain = composeFileChain.length > 1;
-
-    const logContainer = this.log.child({
-      composeFile,
-      services,
-    });
-
-    if (this.configuration.dryrun) {
-      logContainer.info(
-        `Do not refresh compose services ${services.join(', ')} from ${composeFile} because dry-run mode is enabled`,
+      await this.getComposeFileChainAsObject(effectiveComposeFileChain, composeByFile);
+    } catch (e) {
+      throw new Error(
+        `Error when validating compose configuration for ${composeFilePath} (${e.message})`,
       );
-      return;
-    }
-
-    if (runWithComposeFileChain) {
-      await this.runComposeCommand(
-        composeFile,
-        ['pull', ...services],
-        logContainer,
-        composeFileChain,
-      );
-    } else {
-      await this.runComposeCommand(composeFile, ['pull', ...services], logContainer);
-    }
-
-    const servicesToStart: string[] = [];
-    const servicesToKeepStopped: string[] = [];
-    for (const service of services) {
-      if (serviceRunningStates.get(service) === false) {
-        servicesToKeepStopped.push(service);
-      } else {
-        servicesToStart.push(service);
-      }
-    }
-
-    if (servicesToStart.length > 0) {
-      if (runWithComposeFileChain) {
-        await this.runComposeCommand(
-          composeFile,
-          ['up', '-d', '--no-deps', ...servicesToStart],
-          logContainer,
-          composeFileChain,
-        );
-      } else {
-        await this.runComposeCommand(
-          composeFile,
-          ['up', '-d', '--no-deps', ...servicesToStart],
-          logContainer,
-        );
-      }
-    }
-    if (servicesToKeepStopped.length > 0) {
-      if (runWithComposeFileChain) {
-        await this.runComposeCommand(
-          composeFile,
-          ['up', '--no-start', '--no-deps', ...servicesToKeepStopped],
-          logContainer,
-          composeFileChain,
-        );
-      } else {
-        await this.runComposeCommand(
-          composeFile,
-          ['up', '--no-start', '--no-deps', ...servicesToKeepStopped],
-          logContainer,
-        );
-      }
     }
   }
 
@@ -1257,8 +1130,8 @@ class Dockercompose extends Docker {
   }
 
   /**
-   * Override: compose doesn't need to inspect the existing container
-   * (compose CLI handles the container lifecycle). Lighter context.
+   * Override: keep trigger context lightweight. Runtime container state is
+   * resolved on demand inside updateContainerWithCompose().
    */
   async createTriggerContext(container, logContainer, _composeContext) {
     const watcher = this.getWatcher(container);
@@ -1277,7 +1150,8 @@ class Dockercompose extends Docker {
   }
 
   /**
-   * Override: use compose CLI for pull/recreate instead of Docker API.
+   * Override: apply compose-specific hooks while performing runtime refresh
+   * through the Docker Engine API.
    */
   async performContainerUpdate(_context, container, _logContainer, composeCtx) {
     if (!composeCtx) {
@@ -1329,10 +1203,11 @@ class Dockercompose extends Docker {
   }
 
   /**
-   * Self-update for compose-managed Drydock service. This must stay in compose
-   * lifecycle instead of Docker API recreate to preserve compose ownership.
+   * Self-update for compose-managed Drydock service. Delegate to the parent
+   * self-update transition so the helper container can enforce startup/health
+   * gates and rollback before retiring the old process.
    */
-  async executeSelfUpdate(context, container, logContainer, _operationId, composeCtx) {
+  async executeSelfUpdate(context, container, logContainer, operationId, composeCtx) {
     if (!composeCtx) {
       throw new Error(`Missing compose context for self-update container ${container.name}`);
     }
@@ -1342,20 +1217,16 @@ class Dockercompose extends Docker {
       return false;
     }
 
-    this.insertContainerImageBackup(context, container);
-    if (Array.isArray(composeCtx.composeFiles) && composeCtx.composeFiles.length > 1) {
-      await this.updateContainerWithCompose(composeCtx.composeFile, composeCtx.service, container, {
-        composeFiles: composeCtx.composeFiles,
-      });
-    } else {
-      await this.updateContainerWithCompose(composeCtx.composeFile, composeCtx.service, container);
-    }
-    await this.runServicePostStartHooks(
-      container,
-      composeCtx.service,
-      composeCtx.serviceDefinition,
-    );
-    return true;
+    const currentContainer = await this.getCurrentContainer(context.dockerApi, container);
+    const currentContainerSpec = await this.inspectContainer(currentContainer, logContainer);
+
+    const selfUpdateContext = {
+      ...context,
+      currentContainer,
+      currentContainerSpec,
+    };
+
+    return super.executeSelfUpdate(selfUpdateContext, container, logContainer, operationId);
   }
 
   /**
@@ -1572,34 +1443,15 @@ class Dockercompose extends Docker {
       }
     }
 
-    let composeFileOnceHandledServices = new Set<string>();
+    const composeFileOnceHandledServices = new Set<string>();
     if (
       this.configuration.composeFileOnce === true &&
       this.configuration.dryrun !== true &&
       mappingsNeedingRuntimeUpdate.length > 1
     ) {
-      const serviceRunningStates = new Map<string, boolean>();
-      const servicesToRefresh: string[] = [];
-      for (const { container, service } of mappingsNeedingRuntimeUpdate) {
-        if (serviceRunningStates.has(service)) {
-          continue;
-        }
-        const runningStateLogger = this.log.child({
-          container: container.name,
-        });
-        serviceRunningStates.set(
-          service,
-          await this.getContainerRunningState(container, runningStateLogger),
-        );
-        servicesToRefresh.push(service);
-      }
-      await this.updateComposeServicesWithCompose(composeFile, servicesToRefresh, {
-        composeFiles: composeFileChain,
-        serviceRunningStates,
-      });
-      composeFileOnceHandledServices = new Set(servicesToRefresh);
+      // TODO: Re-introduce compose-file-once batching with Docker Engine API primitives.
       this.log.info(
-        `Compose-file-once mode refreshed ${servicesToRefresh.length} service(s) for ${composeFileChainSummary}`,
+        `Compose-file-once mode is unavailable in Docker Engine API runtime mode; refreshing containers individually for ${composeFileChainSummary}. This can be re-implemented via Docker Engine API later.`,
       );
     }
 
@@ -1617,116 +1469,6 @@ class Dockercompose extends Docker {
     }
   }
 
-  async executeCommand(command, args, options = {}) {
-    return new Promise((resolve, reject) => {
-      execFile(
-        command,
-        args,
-        {
-          ...options,
-          timeout: COMPOSE_COMMAND_TIMEOUT_MS,
-          maxBuffer: COMPOSE_COMMAND_MAX_BUFFER_BYTES,
-        },
-        (error, stdout, stderr) => {
-          if (error) {
-            error.stdout = stdout;
-            error.stderr = stderr;
-            reject(error);
-            return;
-          }
-          resolve({
-            stdout: stdout || '',
-            stderr: stderr || '',
-          });
-        },
-      );
-    });
-  }
-
-  async runComposeCommand(composeFile, composeArgs, logContainer, composeFiles = [composeFile]) {
-    const composeFileChain = this.normalizeComposeFileChain(composeFile, composeFiles);
-    const composeFilePaths = composeFileChain.map((composeFilePathToResolve) =>
-      this.resolveComposeFilePath(composeFilePathToResolve),
-    );
-    const composeFileArgs = composeFilePaths.flatMap((composeFilePath) => ['-f', composeFilePath]);
-    const composeWorkingDirectory = path.dirname(composeFilePaths[0]);
-    const composeFilePathSummary = composeFilePaths.join(', ');
-    const commandsToTry = [
-      {
-        command: 'docker',
-        args: ['compose', ...composeFileArgs, ...composeArgs],
-        label: 'docker compose',
-      },
-      {
-        command: 'docker-compose',
-        args: [...composeFileArgs, ...composeArgs],
-        label: 'docker-compose',
-      },
-    ];
-
-    for (const composeCommand of commandsToTry) {
-      try {
-        const { stdout, stderr } = (await this.executeCommand(
-          composeCommand.command,
-          composeCommand.args,
-          {
-            cwd: composeWorkingDirectory,
-            env: buildComposeCommandEnvironment(),
-          },
-        )) as { stdout: string; stderr: string };
-        if (stdout.trim()) {
-          logContainer.debug(
-            `${composeCommand.label} ${composeArgs.join(' ')} stdout:\n${stdout.trim()}`,
-          );
-        }
-        if (stderr.trim()) {
-          logContainer.debug(
-            `${composeCommand.label} ${composeArgs.join(' ')} stderr:\n${stderr.trim()}`,
-          );
-        }
-        return;
-      } catch (e) {
-        const stderr = `${e?.stderr || ''}`;
-        const dockerComposePluginMissing =
-          composeCommand.command === 'docker' &&
-          /docker: ['"]?compose['"]? is not a docker command/i.test(stderr);
-        const executableMissing = e?.code === 'ENOENT';
-
-        if (
-          composeCommand.command === 'docker' &&
-          (dockerComposePluginMissing || executableMissing)
-        ) {
-          logContainer.warn(
-            `Cannot use docker compose for ${composeFilePathSummary} (${e.message}); trying docker-compose`,
-          );
-          continue;
-        }
-
-        throw new Error(
-          `Error when running ${composeCommand.label} ${composeArgs.join(' ')} for ${composeFilePathSummary} (${e.message})`,
-        );
-      }
-    }
-  }
-
-  async getContainerRunningState(container, logContainer) {
-    try {
-      const watcher = this.getWatcher(container);
-      const dockerApi = getDockerApiFromWatcher(watcher);
-      if (!dockerApi) {
-        return true;
-      }
-      const containerToInspect = dockerApi.getContainer(container.name);
-      const containerState = await containerToInspect.inspect();
-      return containerState?.State?.Running !== false;
-    } catch (e) {
-      logContainer.warn(
-        `Unable to inspect running state for ${container.name}; assuming running (${e.message})`,
-      );
-      return true;
-    }
-  }
-
   async resolveComposeServiceContext(container, currentImage) {
     const composeFiles = await this.resolveComposeFilesForContainer(container);
     if (composeFiles.length === 0) {
@@ -1828,11 +1570,6 @@ class Dockercompose extends Docker {
       forceRecreate?: boolean;
       composeFiles?: string[];
     };
-    const composeFileChain = this.normalizeComposeFileChain(
-      composeFile,
-      (options as { composeFiles?: string[] })?.composeFiles,
-    );
-    const runWithComposeFileChain = composeFileChain.length > 1;
 
     if (this.configuration.dryrun) {
       logContainer.info(
@@ -1841,43 +1578,57 @@ class Dockercompose extends Docker {
       return;
     }
 
+    const watcher = this.getWatcher(container);
+    const { dockerApi } = watcher;
+    const registry = this.resolveRegistryManager(container, logContainer, {
+      allowAnonymousFallback: true,
+    });
+    const auth = await registry.getAuthPull();
+    const newImage = this.getNewImageFullName(registry, container);
+    const currentContainer = await this.getCurrentContainer(dockerApi, container);
+    if (!currentContainer) {
+      throw new Error(
+        `Unable to refresh compose service ${service} from ${composeFile} because container ${container.name} no longer exists`,
+      );
+    }
+    const currentContainerSpec = await this.inspectContainer(currentContainer, logContainer);
     const serviceShouldStart =
-      shouldStart !== undefined
-        ? shouldStart
-        : await this.getContainerRunningState(container, logContainer);
+      shouldStart !== undefined ? shouldStart : currentContainerSpec?.State?.Running !== false;
 
-    logContainer.info(`Refresh compose service ${service} from ${composeFile}`);
+    logContainer.info(
+      `Refresh compose service ${service} from ${composeFile} using Docker Engine API`,
+    );
     if (!skipPull) {
-      if (runWithComposeFileChain) {
-        await this.runComposeCommand(
-          composeFile,
-          ['pull', service],
-          logContainer,
-          composeFileChain,
-        );
-      } else {
-        await this.runComposeCommand(composeFile, ['pull', service], logContainer);
-      }
+      await this.pullImage(dockerApi, auth, newImage, logContainer);
     } else {
-      logContainer.debug(`Skip compose pull for ${service} from ${composeFile}`);
+      logContainer.debug(`Skip image pull for ${service} from ${composeFile}`);
     }
-
-    const upArgs = ['up'];
-    if (serviceShouldStart) {
-      upArgs.push('-d');
-    } else {
-      upArgs.push('--no-start');
-    }
-    upArgs.push('--no-deps');
     if (forceRecreate) {
-      upArgs.push('--force-recreate');
-    }
-    upArgs.push(service);
-    if (runWithComposeFileChain) {
-      await this.runComposeCommand(composeFile, upArgs, logContainer, composeFileChain);
-    } else {
-      await this.runComposeCommand(composeFile, upArgs, logContainer);
+      logContainer.debug(
+        `Force recreate requested for ${service}; Docker Engine API path always recreates containers`,
+      );
     }
+
+    const recreationContainerSpec = {
+      ...currentContainerSpec,
+      State: {
+        ...currentContainerSpec?.State,
+        Running: serviceShouldStart,
+      },
+    };
+    await super.stopAndRemoveContainer(
+      currentContainer,
+      currentContainerSpec,
+      container,
+      logContainer,
+    );
+    await super.recreateContainer(
+      dockerApi,
+      recreationContainerSpec,
+      newImage,
+      container,
+      logContainer,
+    );
   }
 
   async stopAndRemoveContainer(_currentContainer, _currentContainerSpec, container, logContainer) {

From 1a2164c746759eac3658beb4d8c551d4d09ce1f7 Mon Sep 17 00:00:00 2001
From: superuserjr <80784472+turbodaemon@users.noreply.github.com>
Date: Mon, 9 Mar 2026 20:17:16 -0400
Subject: [PATCH 02/34] =?UTF-8?q?=F0=9F=90=9B=20fix(api):=20include=20dock?=
 =?UTF-8?q?ercompose=20in=20manual=20update=20trigger=20search?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The updateContainer endpoint only searched for type 'docker' triggers,
missing dockercompose triggers entirely. Add triggerTypes option to
match the preview endpoint behavior.
---
 app/api/container-actions.test.ts | 28 ++++++++++++++++++++++++++++
 app/api/container-actions.ts      |  4 +++-
 2 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/app/api/container-actions.test.ts b/app/api/container-actions.test.ts
index 034ac37d..42c805b5 100644
--- a/app/api/container-actions.test.ts
+++ b/app/api/container-actions.test.ts
@@ -460,6 +460,34 @@ describe('Container Actions Router', () => {
       );
     });
 
+    test('should update container successfully with a dockercompose trigger', async () => {
+      const container = {
+        id: 'c1',
+        name: 'nginx',
+        image: { name: 'nginx' },
+        updateAvailable: true,
+      };
+      const updatedContainer = { ...container, image: { name: 'nginx:latest' } };
+      mockGetContainer.mockReturnValueOnce(container).mockReturnValueOnce(updatedContainer);
+      const mockTriggerFn = vi.fn().mockResolvedValue(undefined);
+      const trigger = { type: 'dockercompose', trigger: mockTriggerFn };
+      mockGetState.mockReturnValue({ trigger: { 'dockercompose.default': trigger } });
+
+      const handler = getHandler('post', '/:id/update');
+      const req = createMockRequest({ params: { id: 'c1' } });
+      const res = createMockResponse();
+      await handler(req, res);
+
+      expect(mockTriggerFn).toHaveBeenCalledWith(container);
+      expect(res.status).toHaveBeenCalledWith(200);
+      expect(res.json).toHaveBeenCalledWith(
+        expect.objectContaining({
+          message: 'Container updated successfully',
+          result: updatedContainer,
+        }),
+      );
+    });
+
     test('should return 404 when container not found', async () => {
       mockGetContainer.mockReturnValue(undefined);
 
diff --git a/app/api/container-actions.ts b/app/api/container-actions.ts
index a1863d09..7bb8778c 100644
--- a/app/api/container-actions.ts
+++ b/app/api/container-actions.ts
@@ -163,7 +163,9 @@ async function updateContainer(req: Request, res: Response) {
     return;
   }
 
-  const trigger = findDockerTriggerForContainer(registry.getState().trigger, container);
+  const trigger = findDockerTriggerForContainer(registry.getState().trigger, container, {
+    triggerTypes: ['docker', 'dockercompose'],
+  });
   if (!trigger) {
     sendErrorResponse(res, 404, NO_DOCKER_TRIGGER_FOUND_ERROR);
     return;

From f139817b78b8ef68e2be7b62ab372e5d9cff2141 Mon Sep 17 00:00:00 2001
From: s-b-e-n-s-o-n <80784472+s-b-e-n-s-o-n@users.noreply.github.com>
Date: Mon, 9 Mar 2026 17:51:21 -0400
Subject: [PATCH 03/34] =?UTF-8?q?=F0=9F=90=9B=20fix(ci):=20retry=20qlty=20?=
 =?UTF-8?q?on=20timeout=20and=20increase=20limit=20to=208=20minutes?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

retry_on was set to "error" which only retries on non-zero exit codes,
not on timeouts. Changed to "any" so the 5-minute timeout actually
triggers a retry. Also bumped timeout from 5 to 8 minutes since qlty
regularly takes longer in CI.
---
 .github/workflows/ci.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 88bebdf1..27c8cac0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -78,9 +78,9 @@ jobs:
       - name: Qlty check (all plugins)
         uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08  # v3.0.2
         with:
-          timeout_minutes: 5
+          timeout_minutes: 8
           max_attempts: 3
-          retry_on: error
+          retry_on: any
           command: qlty check --all --no-progress
 
   test:

From 3945d2c11d968c9c9f0b8f8dd79b44e61e540188 Mon Sep 17 00:00:00 2001
From: superuserjr <80784472+turbodaemon@users.noreply.github.com>
Date: Mon, 9 Mar 2026 20:19:01 -0400
Subject: [PATCH 04/34] =?UTF-8?q?=F0=9F=93=9D=20docs(changelog):=20add=20c?=
 =?UTF-8?q?ompose=20Engine=20API=20and=20trigger=20search=20fixes?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 CHANGELOG.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d60db55c..5f36b5e1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -91,6 +91,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- **Compose trigger uses Docker Engine API** — Compose-managed container updates now use the Docker Engine API directly (pull, stop, recreate) instead of shelling out to `docker compose` / `docker-compose` CLI. Eliminates `spawn docker ENOENT` errors in environments without Docker CLI binaries installed.
+- **Compose self-update delegates to parent orchestrator** — Self-update for compose-managed Drydock containers now uses the parent Docker trigger's helper-container transition with health gates and rollback, instead of direct stop/recreate.
 - **Self-update controller testable entrypoint** — Extracted process-level entry logic to a separate entrypoint module, making the controller independently testable without triggering process-exit side effects.
 - **Dockercompose YAML patching simplified** — Removed redundant type guards and dead-code branches from compose file patching helpers, reducing code paths and improving maintainability.
 - **Dashboard fetches recent-status from backend** — Dashboard now fetches pre-computed container statuses from `/api/containers/recent-status` instead of scanning the raw audit log client-side.
@@ -118,6 +120,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- **Manual update button works with compose triggers** — The update container endpoint now searches for both `docker` and `dockercompose` trigger types, matching the existing preview endpoint behavior. Previously, users with only a compose trigger saw "No docker trigger found for this container".
+- **CI: qlty retry on timeout** — Changed `retry_on` from `error` to `any` so qlty timeouts trigger retries. Increased timeout from 5 to 8 minutes.
 - **Compose trigger rejects compose files mounted outside app directory** — Removed overly strict working-directory boundary enforcement from `runComposeCommand` that rejected compose files bind-mounted outside `/home/node/app`, breaking documented mount patterns like `/drydock/docker-compose.yml`. Compose file paths are operator-configured and already validated during resolution.
 - **Compose trigger uses host paths instead of container paths** — Docker label auto-detection (`com.docker.compose.project.config_files`) now remaps host-side paths to container-internal paths using Drydock's own bind mount information. Previously, host paths like `/mnt/volume1/docker/stacks/monitoring/compose.yaml` were used directly inside the container where they don't exist, causing "does not exist" errors even when the file was properly mounted.
 - **Compose trigger logs spurious warnings for unrelated containers** — When multiple compose triggers are configured, each trigger now silently skips containers whose resolved compose files don't match the trigger's configured `FILE` path, eliminating noisy cross-stack "does not exist" warnings.

From 25413d52d7a6c820d8e37e90ec1d64ba48d978cc Mon Sep 17 00:00:00 2001
From: superuserjr <80784472+turbodaemon@users.noreply.github.com>
Date: Mon, 9 Mar 2026 21:20:22 -0400
Subject: [PATCH 05/34] =?UTF-8?q?=E2=99=BB=EF=B8=8F=20refactor(compose):?=
 =?UTF-8?q?=20extract=20shared=20runtime=20refresh=20and=20re-enable=20com?=
 =?UTF-8?q?poseFileOnce?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Extract refreshComposeServiceWithDockerApi() as shared private helper
  called by both updateContainerWithCompose() and recreateContainer(),
  eliminating the recursive call chain
- Add ensureComposeRuntimeState() guard that throws when inspect data
  is missing State.Running
- Re-enable composeFileOnce batch mode: first container per service
  gets a full runtime refresh, subsequent containers for the same
  service skip the refresh via composeFileOnceApplied flag
- Add error-path tests for pullImage, stopAndRemoveContainer,
  recreateContainer failures, and malformed inspect data
---
 .../dockercompose/Dockercompose.test.ts       | 486 +++++++++++++++++-
 .../providers/dockercompose/Dockercompose.ts  | 214 ++++++--
 2 files changed, 640 insertions(+), 60 deletions(-)

diff --git a/app/triggers/providers/dockercompose/Dockercompose.test.ts b/app/triggers/providers/dockercompose/Dockercompose.test.ts
index fbcdb16b..e11d2042 100644
--- a/app/triggers/providers/dockercompose/Dockercompose.test.ts
+++ b/app/triggers/providers/dockercompose/Dockercompose.test.ts
@@ -477,6 +477,11 @@ describe('Dockercompose Trigger', () => {
       '/opt/drydock/test/portainer.yml',
       'portainer',
       container,
+      expect.objectContaining({
+        runtimeContext: expect.objectContaining({
+          dockerApi: mockDockerApi,
+        }),
+      }),
     );
   });
 
@@ -509,11 +514,21 @@ describe('Dockercompose Trigger', () => {
       '/opt/drydock/test/stack.yml',
       'nginx',
       tagContainer,
+      expect.objectContaining({
+        runtimeContext: expect.objectContaining({
+          dockerApi: mockDockerApi,
+        }),
+      }),
     );
     expect(composeUpdateSpy).toHaveBeenCalledWith(
       '/opt/drydock/test/stack.yml',
       'redis',
       digestContainer,
+      expect.objectContaining({
+        runtimeContext: expect.objectContaining({
+          dockerApi: mockDockerApi,
+        }),
+      }),
     );
   });
 
@@ -542,6 +557,11 @@ describe('Dockercompose Trigger', () => {
       '/opt/drydock/test/stack.yml',
       'redis',
       container,
+      expect.objectContaining({
+        runtimeContext: expect.objectContaining({
+          dockerApi: mockDockerApi,
+        }),
+      }),
     );
   });
 
@@ -571,6 +591,11 @@ describe('Dockercompose Trigger', () => {
       '/opt/drydock/test/stack.yml',
       'redis',
       container,
+      expect.objectContaining({
+        runtimeContext: expect.objectContaining({
+          dockerApi: mockDockerApi,
+        }),
+      }),
     );
   });
 
@@ -598,6 +623,11 @@ describe('Dockercompose Trigger', () => {
       '/opt/drydock/test/stack.yml',
       'nginx',
       container,
+      expect.objectContaining({
+        runtimeContext: expect.objectContaining({
+          dockerApi: mockDockerApi,
+        }),
+      }),
     );
   });
 
@@ -657,6 +687,11 @@ describe('Dockercompose Trigger', () => {
       '/opt/drydock/test/stack.yml',
       'filebrowser',
       container,
+      expect.objectContaining({
+        runtimeContext: expect.objectContaining({
+          dockerApi: mockDockerApi,
+        }),
+      }),
     );
   });
 
@@ -1078,6 +1113,11 @@ describe('Dockercompose Trigger', () => {
       '/opt/drydock/test/stack.yml',
       'nginx',
       container1,
+      expect.objectContaining({
+        runtimeContext: expect.objectContaining({
+          dockerApi: mockDockerApi,
+        }),
+      }),
     );
   });
 
@@ -1115,6 +1155,11 @@ describe('Dockercompose Trigger', () => {
       '/opt/drydock/test/stack.yml',
       'nginx',
       containerInProject,
+      expect.objectContaining({
+        runtimeContext: expect.objectContaining({
+          dockerApi: mockDockerApi,
+        }),
+      }),
     );
   });
 
@@ -1224,6 +1269,11 @@ describe('Dockercompose Trigger', () => {
       '/opt/drydock/test/stack.yml',
       'nginx',
       container1,
+      expect.objectContaining({
+        runtimeContext: expect.objectContaining({
+          dockerApi: mockDockerApi,
+        }),
+      }),
     );
   });
 
@@ -1267,7 +1317,7 @@ describe('Dockercompose Trigger', () => {
     trigger.configuration.dryrun = false;
     const pullImageSpy = vi.spyOn(trigger, 'pullImage').mockResolvedValue();
     const startContainerSpy = vi.spyOn(trigger, 'startContainer').mockResolvedValue();
-    mockDockerApi.getContainer.mockReturnValueOnce(
+    vi.spyOn(trigger, 'getCurrentContainer').mockResolvedValue(
       makeDockerContainerHandle({
         running: false,
       }),
@@ -1313,6 +1363,32 @@ describe('Dockercompose Trigger', () => {
     expect(pullImageSpy).not.toHaveBeenCalled();
   });
 
+  test('updateContainerWithCompose should reuse runtime context without resolving registry manager', async () => {
+    trigger.configuration.dryrun = false;
+    const container = makeContainer({ name: 'nginx' });
+    const pullImageSpy = vi.spyOn(trigger, 'pullImage').mockResolvedValue();
+    const resolveRegistryManagerSpy = vi.spyOn(trigger, 'resolveRegistryManager');
+    const getWatcherSpy = vi.spyOn(trigger, 'getWatcher');
+    const runtimeContext = {
+      dockerApi: mockDockerApi,
+      auth: { from: 'context' },
+      newImage: 'nginx:9.9.9',
+    };
+
+    await trigger.updateContainerWithCompose('/opt/drydock/test/stack.yml', 'nginx', container, {
+      runtimeContext,
+    });
+
+    expect(resolveRegistryManagerSpy).not.toHaveBeenCalled();
+    expect(getWatcherSpy).not.toHaveBeenCalled();
+    expect(pullImageSpy).toHaveBeenCalledWith(
+      runtimeContext.dockerApi,
+      runtimeContext.auth,
+      runtimeContext.newImage,
+      expect.anything(),
+    );
+  });
+
   test('updateContainerWithCompose should throw when current container cannot be resolved', async () => {
     trigger.configuration.dryrun = false;
     const container = makeContainer({ name: 'nginx' });
@@ -1325,6 +1401,66 @@ describe('Dockercompose Trigger', () => {
     );
   });
 
+  test('updateContainerWithCompose should surface pullImage failures and stop before recreation', async () => {
+    trigger.configuration.dryrun = false;
+    const container = makeContainer({ name: 'nginx' });
+    vi.spyOn(trigger, 'pullImage').mockRejectedValue(new Error('pull failed'));
+    const stopContainerSpy = vi.spyOn(trigger, 'stopContainer').mockResolvedValue();
+    const createContainerSpy = vi.spyOn(trigger, 'createContainer').mockResolvedValue({
+      start: vi.fn().mockResolvedValue(undefined),
+    } as any);
+
+    await expect(
+      trigger.updateContainerWithCompose('/opt/drydock/test/stack.yml', 'nginx', container),
+    ).rejects.toThrow('pull failed');
+
+    expect(stopContainerSpy).not.toHaveBeenCalled();
+    expect(createContainerSpy).not.toHaveBeenCalled();
+  });
+
+  test('updateContainerWithCompose should surface stopAndRemoveContainer failures and skip recreation', async () => {
+    trigger.configuration.dryrun = false;
+    const container = makeContainer({ name: 'nginx' });
+    vi.spyOn(trigger, 'pullImage').mockResolvedValue();
+    vi.spyOn(trigger, 'stopContainer').mockRejectedValue(new Error('stop failed'));
+    const createContainerSpy = vi.spyOn(trigger, 'createContainer').mockResolvedValue({
+      start: vi.fn().mockResolvedValue(undefined),
+    } as any);
+
+    await expect(
+      trigger.updateContainerWithCompose('/opt/drydock/test/stack.yml', 'nginx', container),
+    ).rejects.toThrow('stop failed');
+
+    expect(createContainerSpy).not.toHaveBeenCalled();
+  });
+
+  test('updateContainerWithCompose should surface recreateContainer failures', async () => {
+    trigger.configuration.dryrun = false;
+    const container = makeContainer({ name: 'nginx' });
+    vi.spyOn(trigger, 'pullImage').mockResolvedValue();
+    vi.spyOn(trigger, 'stopContainer').mockResolvedValue();
+    vi.spyOn(trigger, 'removeContainer').mockResolvedValue();
+    vi.spyOn(trigger, 'createContainer').mockRejectedValue(new Error('create failed'));
+
+    await expect(
+      trigger.updateContainerWithCompose('/opt/drydock/test/stack.yml', 'nginx', container),
+    ).rejects.toThrow('create failed');
+  });
+
+  test('updateContainerWithCompose should throw when inspectContainer returns malformed runtime state', async () => {
+    trigger.configuration.dryrun = false;
+    const container = makeContainer({ name: 'nginx' });
+    vi.spyOn(trigger, 'inspectContainer').mockResolvedValue({
+      Config: { Image: 'nginx:1.0.0' },
+    } as any);
+
+    await expect(
+      trigger.updateContainerWithCompose('/opt/drydock/test/stack.yml', 'nginx', container),
+    ).rejects.toThrow(
+      'Unable to refresh compose service nginx from /opt/drydock/test/stack.yml because Docker inspection data is missing runtime state',
+    );
+  });
+
   test('stopAndRemoveContainer should be a no-op with compose lifecycle log', async () => {
     await trigger.stopAndRemoveContainer({}, {}, { name: 'nginx' }, mockLog);
 
@@ -1333,7 +1469,7 @@ describe('Dockercompose Trigger', () => {
     );
   });
 
-  test('recreateContainer should rewrite compose service image and recreate via compose lifecycle', async () => {
+  test('recreateContainer should rewrite compose service image without routing through updateContainerWithCompose', async () => {
     const container = makeContainer({
       name: 'nginx',
       labels: {
@@ -1350,7 +1486,7 @@ describe('Dockercompose Trigger', () => {
     ].join('\n');
     vi.spyOn(trigger, 'getComposeFile').mockResolvedValue(Buffer.from(composeFileContent));
     const writeComposeFileSpy = vi.spyOn(trigger, 'writeComposeFile').mockResolvedValue();
-    const composeUpdateSpy = vi.spyOn(trigger, 'updateContainerWithCompose').mockResolvedValue();
+    const composeUpdateSpy = vi.spyOn(trigger, 'updateContainerWithCompose');
     vi.spyOn(trigger, 'getComposeFileAsObject').mockResolvedValue(
       makeCompose({ nginx: { image: 'nginx:1.1.0' } }),
     );
@@ -1374,16 +1510,7 @@ describe('Dockercompose Trigger', () => {
       '/opt/drydock/test/stack.yml',
       expect.stringContaining('# existing comment'),
     );
-    expect(composeUpdateSpy).toHaveBeenCalledWith(
-      '/opt/drydock/test/stack.yml',
-      'nginx',
-      container,
-      {
-        shouldStart: false,
-        skipPull: true,
-        forceRecreate: true,
-      },
-    );
+    expect(composeUpdateSpy).not.toHaveBeenCalled();
   });
 
   test('recreateContainer should fallback to registry-derived image when current spec image is missing', async () => {
@@ -1524,6 +1651,135 @@ describe('Dockercompose Trigger', () => {
     expect(hooksSpy).not.toHaveBeenCalled();
   });
 
+  test('executeSelfUpdate should reuse current container and inspection from context when available', async () => {
+    trigger.configuration.dryrun = false;
+    const container = makeContainer({
+      name: 'drydock',
+      imageName: 'codeswhat/drydock',
+      labels: {
+        'dd.compose.file': '/opt/drydock/test/stack.yml',
+        'com.docker.compose.service': 'drydock',
+      },
+    });
+    const composeContext = {
+      composeFile: '/opt/drydock/test/stack.yml',
+      service: 'drydock',
+      serviceDefinition: {},
+    };
+    const currentContainer = makeDockerContainerHandle({ id: 'context-container-id' });
+    const currentContainerSpec = {
+      Id: 'context-id',
+      Name: '/drydock',
+      State: { Running: true },
+      HostConfig: {
+        Binds: ['/var/run/docker.sock:/var/run/docker.sock'],
+      },
+    };
+
+    const getCurrentContainerSpy = vi
+      .spyOn(trigger, 'getCurrentContainer')
+      .mockResolvedValue(makeDockerContainerHandle({ id: 'fetched-id' }));
+    const inspectContainerSpy = vi.spyOn(trigger, 'inspectContainer').mockResolvedValue({
+      Id: 'fetched-id',
+      State: { Running: true },
+    } as any);
+    const orchestratorExecuteSpy = vi
+      .spyOn(trigger.selfUpdateOrchestrator, 'execute')
+      .mockResolvedValue(true);
+
+    const updated = await trigger.executeSelfUpdate(
+      {
+        dockerApi: mockDockerApi,
+        registry: getState().registry.hub,
+        auth: {},
+        newImage: 'codeswhat/drydock:1.1.0',
+        currentContainer,
+        currentContainerSpec,
+      },
+      container,
+      mockLog,
+      'op-self-update-context',
+      composeContext,
+    );
+
+    expect(updated).toBe(true);
+    expect(getCurrentContainerSpy).not.toHaveBeenCalled();
+    expect(inspectContainerSpy).not.toHaveBeenCalled();
+    expect(orchestratorExecuteSpy).toHaveBeenCalledWith(
+      expect.objectContaining({
+        currentContainer,
+        currentContainerSpec,
+      }),
+      container,
+      mockLog,
+      'op-self-update-context',
+    );
+  });
+
+  test('executeSelfUpdate should inspect context current container when inspection is missing', async () => {
+    trigger.configuration.dryrun = false;
+    const container = makeContainer({
+      name: 'drydock',
+      imageName: 'codeswhat/drydock',
+      labels: {
+        'dd.compose.file': '/opt/drydock/test/stack.yml',
+        'com.docker.compose.service': 'drydock',
+      },
+    });
+    const composeContext = {
+      composeFile: '/opt/drydock/test/stack.yml',
+      service: 'drydock',
+      serviceDefinition: {},
+    };
+    const currentContainer = makeDockerContainerHandle({ id: 'context-container-id' });
+    const currentContainerSpec = {
+      Id: 'context-inspected-id',
+      Name: '/drydock',
+      State: { Running: true },
+      HostConfig: {
+        Binds: ['/var/run/docker.sock:/var/run/docker.sock'],
+      },
+    };
+
+    const getCurrentContainerSpy = vi
+      .spyOn(trigger, 'getCurrentContainer')
+      .mockResolvedValue(makeDockerContainerHandle({ id: 'fetched-id' }));
+    const inspectContainerSpy = vi
+      .spyOn(trigger, 'inspectContainer')
+      .mockResolvedValue(currentContainerSpec as any);
+    const orchestratorExecuteSpy = vi
+      .spyOn(trigger.selfUpdateOrchestrator, 'execute')
+      .mockResolvedValue(true);
+
+    const updated = await trigger.executeSelfUpdate(
+      {
+        dockerApi: mockDockerApi,
+        registry: getState().registry.hub,
+        auth: {},
+        newImage: 'codeswhat/drydock:1.1.0',
+        currentContainer,
+        currentContainerSpec: null,
+      },
+      container,
+      mockLog,
+      undefined,
+      composeContext,
+    );
+
+    expect(updated).toBe(true);
+    expect(getCurrentContainerSpy).not.toHaveBeenCalled();
+    expect(inspectContainerSpy).toHaveBeenCalledWith(currentContainer, mockLog);
+    expect(orchestratorExecuteSpy).toHaveBeenCalledWith(
+      expect.objectContaining({
+        currentContainer,
+        currentContainerSpec,
+      }),
+      container,
+      mockLog,
+      undefined,
+    );
+  });
+
   test('performContainerUpdate should throw when compose context is missing', async () => {
     await expect(
       trigger.performContainerUpdate(
@@ -3350,7 +3606,7 @@ describe('Dockercompose Trigger', () => {
     expect(parseDocumentSpy).toHaveBeenCalledTimes(1);
   });
 
-  test('processComposeFile should skip compose-file-once batching in Docker Engine API mode', async () => {
+  test('processComposeFile should refresh each distinct service in compose-file-once mode', async () => {
     trigger.configuration.dryrun = false;
     trigger.configuration.prune = false;
     trigger.configuration.composeFileOnce = true;
@@ -3400,8 +3656,91 @@ describe('Dockercompose Trigger', () => {
     ]);
 
     expect(runContainerUpdateLifecycleSpy).toHaveBeenCalledTimes(2);
-    expect(mockLog.info).toHaveBeenCalledWith(
-      expect.stringContaining('can be re-implemented via Docker Engine API later'),
+    expect(runContainerUpdateLifecycleSpy).toHaveBeenNthCalledWith(
+      1,
+      nginxContainer,
+      expect.objectContaining({
+        service: 'nginx',
+        composeFileOnceApplied: false,
+      }),
+    );
+    expect(runContainerUpdateLifecycleSpy).toHaveBeenNthCalledWith(
+      2,
+      redisContainer,
+      expect.objectContaining({
+        service: 'redis',
+        composeFileOnceApplied: false,
+      }),
+    );
+  });
+
+  test('processComposeFile should pre-pull distinct services and skip per-service pull in compose-file-once mode', async () => {
+    trigger.configuration.dryrun = false;
+    trigger.configuration.prune = false;
+    trigger.configuration.composeFileOnce = true;
+
+    const nginxContainer = makeContainer({
+      labels: { 'com.docker.compose.service': 'nginx' },
+    });
+    const redisContainer = makeContainer({
+      name: 'redis',
+      imageName: 'redis',
+      tagValue: '7.0.0',
+      remoteValue: '7.1.0',
+      labels: { 'com.docker.compose.service': 'redis' },
+    });
+
+    vi.spyOn(trigger, 'getComposeFileAsObject').mockResolvedValue(
+      makeCompose({
+        nginx: { image: 'nginx:1.0.0' },
+        redis: { image: 'redis:7.0.0' },
+      }),
+    );
+    vi.spyOn(trigger, 'getComposeFile').mockResolvedValue(
+      Buffer.from(
+        [
+          'services:',
+          '  nginx:',
+          '    image: nginx:1.0.0',
+          '  redis:',
+          '    image: redis:7.0.0',
+          '',
+        ].join('\n'),
+      ),
+    );
+    vi.spyOn(trigger, 'writeComposeFile').mockResolvedValue();
+    const pullImageSpy = vi.spyOn(trigger, 'pullImage').mockResolvedValue();
+    const updateContainerWithComposeSpy = vi
+      .spyOn(trigger, 'updateContainerWithCompose')
+      .mockResolvedValue();
+    vi.spyOn(trigger, 'runServicePostStartHooks').mockResolvedValue();
+    vi.spyOn(trigger, 'maybeScanAndGateUpdate').mockResolvedValue();
+    vi.spyOn(trigger, 'runPreUpdateHook').mockResolvedValue();
+    vi.spyOn(trigger, 'runPostUpdateHook').mockResolvedValue();
+    vi.spyOn(trigger, 'cleanupOldImages').mockResolvedValue();
+    vi.spyOn(trigger, 'maybeStartAutoRollbackMonitor').mockResolvedValue();
+
+    await trigger.processComposeFile('/opt/drydock/test/stack.yml', [
+      nginxContainer,
+      redisContainer,
+    ]);
+
+    expect(pullImageSpy).toHaveBeenCalledTimes(2);
+    expect(updateContainerWithComposeSpy).toHaveBeenCalledWith(
+      '/opt/drydock/test/stack.yml',
+      'nginx',
+      nginxContainer,
+      expect.objectContaining({
+        skipPull: true,
+      }),
+    );
+    expect(updateContainerWithComposeSpy).toHaveBeenCalledWith(
+      '/opt/drydock/test/stack.yml',
+      'redis',
+      redisContainer,
+      expect.objectContaining({
+        skipPull: true,
+      }),
     );
   });
 
@@ -4290,6 +4629,47 @@ describe('Dockercompose Trigger', () => {
     );
   });
 
+  test('performContainerUpdate should pass runtime context to per-service update when available', async () => {
+    trigger.configuration.dryrun = false;
+    const container = makeContainer({
+      name: 'nginx',
+    });
+    const updateContainerWithComposeSpy = vi
+      .spyOn(trigger, 'updateContainerWithCompose')
+      .mockResolvedValue();
+    vi.spyOn(trigger, 'runServicePostStartHooks').mockResolvedValue();
+    const runtimeContext = {
+      dockerApi: mockDockerApi,
+      auth: { from: 'context' },
+      newImage: 'nginx:9.9.9',
+      registry: getState().registry.hub,
+    };
+
+    const updated = await trigger.performContainerUpdate(
+      runtimeContext as any,
+      container as any,
+      mockLog,
+      {
+        composeFile: '/opt/drydock/test/stack.override.yml',
+        composeFiles: ['/opt/drydock/test/stack.yml', '/opt/drydock/test/stack.override.yml'],
+        service: 'nginx',
+        serviceDefinition: {},
+        composeFileOnceApplied: false,
+      } as any,
+    );
+
+    expect(updated).toBe(true);
+    expect(updateContainerWithComposeSpy).toHaveBeenCalledWith(
+      '/opt/drydock/test/stack.override.yml',
+      'nginx',
+      container,
+      {
+        composeFiles: ['/opt/drydock/test/stack.yml', '/opt/drydock/test/stack.override.yml'],
+        runtimeContext,
+      },
+    );
+  });
+
   test('performContainerUpdate should skip per-service refresh when compose-file-once is already applied', async () => {
     trigger.configuration.dryrun = false;
     const container = makeContainer({
@@ -4370,7 +4750,7 @@ describe('Dockercompose Trigger', () => {
     expect(updateContainerWithComposeSpy).not.toHaveBeenCalled();
   });
 
-  test('processComposeFile should bypass running-state batching in compose-file-once mode for Docker Engine API runtime', async () => {
+  test('processComposeFile should mark repeated compose services as already refreshed in compose-file-once mode', async () => {
     trigger.configuration.dryrun = false;
     trigger.configuration.composeFileOnce = true;
     const firstContainer = makeContainer({
@@ -4401,6 +4781,72 @@ describe('Dockercompose Trigger', () => {
     ]);
 
     expect(runContainerUpdateLifecycleSpy).toHaveBeenCalledTimes(2);
+    expect(runContainerUpdateLifecycleSpy).toHaveBeenNthCalledWith(
+      1,
+      firstContainer,
+      expect.objectContaining({
+        service: 'nginx',
+        composeFileOnceApplied: false,
+      }),
+    );
+    expect(runContainerUpdateLifecycleSpy).toHaveBeenNthCalledWith(
+      2,
+      secondContainer,
+      expect.objectContaining({
+        service: 'nginx',
+        composeFileOnceApplied: true,
+      }),
+    );
+  });
+
+  test('processComposeFile should pre-pull once for repeated compose services in compose-file-once mode', async () => {
+    trigger.configuration.dryrun = false;
+    trigger.configuration.prune = false;
+    trigger.configuration.composeFileOnce = true;
+    const firstContainer = makeContainer({
+      name: 'nginx-a',
+      labels: { 'com.docker.compose.service': 'nginx' },
+    });
+    const secondContainer = makeContainer({
+      name: 'nginx-b',
+      labels: { 'com.docker.compose.service': 'nginx' },
+    });
+
+    vi.spyOn(trigger, 'getComposeFileAsObject').mockResolvedValue(
+      makeCompose({
+        nginx: { image: 'nginx:1.0.0' },
+      }),
+    );
+    vi.spyOn(trigger, 'getComposeFile').mockResolvedValue(
+      Buffer.from(['services:', '  nginx:', '    image: nginx:1.0.0', ''].join('\n')),
+    );
+    vi.spyOn(trigger, 'writeComposeFile').mockResolvedValue();
+    const pullImageSpy = vi.spyOn(trigger, 'pullImage').mockResolvedValue();
+    const updateContainerWithComposeSpy = vi
+      .spyOn(trigger, 'updateContainerWithCompose')
+      .mockResolvedValue();
+    vi.spyOn(trigger, 'runServicePostStartHooks').mockResolvedValue();
+    vi.spyOn(trigger, 'maybeScanAndGateUpdate').mockResolvedValue();
+    vi.spyOn(trigger, 'runPreUpdateHook').mockResolvedValue();
+    vi.spyOn(trigger, 'runPostUpdateHook').mockResolvedValue();
+    vi.spyOn(trigger, 'cleanupOldImages').mockResolvedValue();
+    vi.spyOn(trigger, 'maybeStartAutoRollbackMonitor').mockResolvedValue();
+
+    await trigger.processComposeFile('/opt/drydock/test/stack.yml', [
+      firstContainer,
+      secondContainer,
+    ]);
+
+    expect(pullImageSpy).toHaveBeenCalledTimes(1);
+    expect(updateContainerWithComposeSpy).toHaveBeenCalledTimes(1);
+    expect(updateContainerWithComposeSpy).toHaveBeenCalledWith(
+      '/opt/drydock/test/stack.yml',
+      'nginx',
+      firstContainer,
+      expect.objectContaining({
+        skipPull: true,
+      }),
+    );
   });
 
   test('preview should passthrough base preview errors without compose metadata', async () => {
@@ -4511,7 +4957,9 @@ describe('Dockercompose Trigger', () => {
       service: 'nginx',
     } as any);
     vi.spyOn(trigger, 'mutateComposeFile').mockResolvedValue(true);
-    const composeUpdateSpy = vi.spyOn(trigger, 'updateContainerWithCompose').mockResolvedValue();
+    const refreshComposeServiceSpy = vi
+      .spyOn(trigger as any, 'refreshComposeServiceWithDockerApi')
+      .mockResolvedValue();
 
     await trigger.recreateContainer(
       mockDockerApi,
@@ -4524,7 +4972,7 @@ describe('Dockercompose Trigger', () => {
       mockLog,
     );
 
-    expect(composeUpdateSpy).toHaveBeenCalledWith(
+    expect(refreshComposeServiceSpy).toHaveBeenCalledWith(
       '/opt/drydock/test/stack.override.yml',
       'nginx',
       container,
diff --git a/app/triggers/providers/dockercompose/Dockercompose.ts b/app/triggers/providers/dockercompose/Dockercompose.ts
index 6c19f6b4..e32ca2cb 100644
--- a/app/triggers/providers/dockercompose/Dockercompose.ts
+++ b/app/triggers/providers/dockercompose/Dockercompose.ts
@@ -88,6 +88,19 @@ type RegistryImageContainerReference = {
   };
 };
 
+type ComposeRuntimeRefreshOptions = {
+  shouldStart?: boolean;
+  skipPull?: boolean;
+  forceRecreate?: boolean;
+  composeFiles?: string[];
+  runtimeContext?: {
+    dockerApi?: unknown;
+    auth?: unknown;
+    newImage?: string;
+    registry?: unknown;
+  };
+};
+
 function getDockerApiFromWatcher(watcher: unknown): DockerApiLike | undefined {
   if (!watcher || typeof watcher !== 'object') {
     return undefined;
@@ -1130,10 +1143,28 @@ class Dockercompose extends Docker {
   }
 
   /**
-   * Override: keep trigger context lightweight. Runtime container state is
-   * resolved on demand inside updateContainerWithCompose().
+   * Override: provide shared runtime dependencies once per lifecycle run.
+   * Runtime container state is still resolved on demand per service refresh.
    */
-  async createTriggerContext(container, logContainer, _composeContext) {
+  async createTriggerContext(container, logContainer, composeContext) {
+    const runtimeContext = (composeContext as { runtimeContext?: unknown } | undefined)
+      ?.runtimeContext as ComposeRuntimeRefreshOptions['runtimeContext'] | undefined;
+    if (
+      runtimeContext?.dockerApi &&
+      runtimeContext?.registry &&
+      runtimeContext?.auth !== undefined &&
+      runtimeContext?.newImage
+    ) {
+      return {
+        dockerApi: runtimeContext.dockerApi,
+        registry: runtimeContext.registry,
+        auth: runtimeContext.auth,
+        newImage: runtimeContext.newImage,
+        currentContainer: null,
+        currentContainerSpec: null,
+      };
+    }
+
     const watcher = this.getWatcher(container);
     const { dockerApi } = watcher;
     const registry = getState().registry[container.image.registry.name];
@@ -1153,10 +1184,26 @@ class Dockercompose extends Docker {
    * Override: apply compose-specific hooks while performing runtime refresh
    * through the Docker Engine API.
    */
-  async performContainerUpdate(_context, container, _logContainer, composeCtx) {
+  async performContainerUpdate(context, container, _logContainer, composeCtx) {
     if (!composeCtx) {
       throw new Error(`Missing compose context for container ${container.name}`);
     }
+    const composeRuntimeContext = (composeCtx as { runtimeContext?: unknown })?.runtimeContext as
+      | ComposeRuntimeRefreshOptions['runtimeContext']
+      | undefined;
+    const runtimeContext = {
+      dockerApi: context?.dockerApi,
+      auth: context?.auth,
+      newImage: context?.newImage,
+      registry: context?.registry,
+      ...(composeRuntimeContext || {}),
+    };
+    const hasRuntimeContext =
+      runtimeContext.dockerApi !== undefined ||
+      runtimeContext.auth !== undefined ||
+      runtimeContext.newImage !== undefined ||
+      runtimeContext.registry !== undefined;
+
     if (composeCtx.composeFileOnceApplied === true) {
       const logContainer = this.log.child({
         container: container.name,
@@ -1172,6 +1219,8 @@ class Dockercompose extends Docker {
           container,
           {
             composeFiles: composeCtx.composeFiles,
+            ...(composeCtx.skipPull === true ? { skipPull: true } : {}),
+            ...(hasRuntimeContext ? { runtimeContext } : {}),
           },
         );
       } else {
@@ -1179,6 +1228,10 @@ class Dockercompose extends Docker {
           composeCtx.composeFile,
           composeCtx.service,
           container,
+          {
+            ...(composeCtx.skipPull === true ? { skipPull: true } : {}),
+            ...(hasRuntimeContext ? { runtimeContext } : {}),
+          },
         );
       }
     }
@@ -1217,8 +1270,11 @@ class Dockercompose extends Docker {
       return false;
     }
 
-    const currentContainer = await this.getCurrentContainer(context.dockerApi, container);
-    const currentContainerSpec = await this.inspectContainer(currentContainer, logContainer);
+    const currentContainer =
+      context?.currentContainer ?? (await this.getCurrentContainer(context.dockerApi, container));
+    const currentContainerSpec =
+      context?.currentContainerSpec ??
+      (await this.inspectContainer(currentContainer, logContainer));
 
     const selfUpdateContext = {
       ...context,
@@ -1444,28 +1500,68 @@ class Dockercompose extends Docker {
     }
 
     const composeFileOnceHandledServices = new Set<string>();
-    if (
-      this.configuration.composeFileOnce === true &&
-      this.configuration.dryrun !== true &&
-      mappingsNeedingRuntimeUpdate.length > 1
-    ) {
-      // TODO: Re-introduce compose-file-once batching with Docker Engine API primitives.
-      this.log.info(
-        `Compose-file-once mode is unavailable in Docker Engine API runtime mode; refreshing containers individually for ${composeFileChainSummary}. This can be re-implemented via Docker Engine API later.`,
+    const composeFileOnceEnabled =
+      this.configuration.composeFileOnce === true && this.configuration.dryrun !== true;
+    const composeFileOnceRuntimeContextByService = new Map<
+      string,
+      NonNullable<ComposeRuntimeRefreshOptions['runtimeContext']>
+    >();
+    if (composeFileOnceEnabled) {
+      const firstContainerByService = new Map<
+        string,
+        (typeof mappingsNeedingRuntimeUpdate)[number]
+      >();
+      for (const mapping of mappingsNeedingRuntimeUpdate) {
+        if (!firstContainerByService.has(mapping.service)) {
+          firstContainerByService.set(mapping.service, mapping);
+        }
+      }
+      await Promise.all(
+        [...firstContainerByService.entries()].map(async ([service, mapping]) => {
+          const runtimeContainer = mapping.container;
+          const logContainer = this.log.child({
+            container: runtimeContainer.name,
+          });
+          const watcher = this.getWatcher(runtimeContainer);
+          const { dockerApi } = watcher;
+          const registry = this.resolveRegistryManager(runtimeContainer, logContainer, {
+            allowAnonymousFallback: true,
+          });
+          const auth = await registry.getAuthPull();
+          const newImage = this.getNewImageFullName(registry, runtimeContainer);
+          composeFileOnceRuntimeContextByService.set(service, {
+            dockerApi,
+            registry,
+            auth,
+            newImage,
+          });
+          await this.pullImage(dockerApi, auth, newImage, logContainer);
+        }),
       );
     }
 
     // Refresh all containers requiring a runtime update via the shared
     // lifecycle orchestrator (security gate, hooks, prune/backup, events).
     for (const { container, service } of mappingsNeedingRuntimeUpdate) {
+      const composeFileOnceApplied =
+        composeFileOnceEnabled && composeFileOnceHandledServices.has(service);
+      const composeFileOnceRuntimeContext = composeFileOnceRuntimeContextByService.get(service);
       const composeContext = {
         composeFile,
         composeFiles: composeFileChain,
         service,
         serviceDefinition: compose.services[service],
-        composeFileOnceApplied: composeFileOnceHandledServices.has(service),
+        composeFileOnceApplied,
+        skipPull:
+          composeFileOnceEnabled &&
+          composeFileOnceApplied !== true &&
+          composeFileOnceRuntimeContext !== undefined,
+        runtimeContext: composeFileOnceRuntimeContext,
       };
       await this.runContainerUpdateLifecycle(container, composeContext);
+      if (composeFileOnceEnabled && !composeFileOnceApplied) {
+        composeFileOnceHandledServices.add(service);
+      }
     }
   }
 
@@ -1556,20 +1652,33 @@ class Dockercompose extends Docker {
   }
 
   async updateContainerWithCompose(composeFile, service, container, options = {}) {
+    await this.refreshComposeServiceWithDockerApi(composeFile, service, container, options);
+  }
+
+  private ensureComposeRuntimeState(currentContainerSpec, composeFile, service): void {
+    if (typeof currentContainerSpec?.State?.Running !== 'boolean') {
+      throw new Error(
+        `Unable to refresh compose service ${service} from ${composeFile} because Docker inspection data is missing runtime state`,
+      );
+    }
+  }
+
+  /**
+   * Refresh one compose-managed service by using the Docker Engine API
+   * directly. Shared by updateContainerWithCompose() and recreateContainer()
+   * to keep the runtime recreation path explicit and non-recursive.
+   */
+  private async refreshComposeServiceWithDockerApi(
+    composeFile,
+    service,
+    container,
+    options: ComposeRuntimeRefreshOptions = {},
+  ) {
     const logContainer = this.log.child({
       container: container.name,
     });
 
-    const {
-      shouldStart = undefined,
-      skipPull = false,
-      forceRecreate = false,
-    } = options as {
-      shouldStart?: boolean;
-      skipPull?: boolean;
-      forceRecreate?: boolean;
-      composeFiles?: string[];
-    };
+    const { shouldStart = undefined, skipPull = false, forceRecreate = false } = options;
 
     if (this.configuration.dryrun) {
       logContainer.info(
@@ -1578,13 +1687,24 @@ class Dockercompose extends Docker {
       return;
     }
 
-    const watcher = this.getWatcher(container);
-    const { dockerApi } = watcher;
-    const registry = this.resolveRegistryManager(container, logContainer, {
-      allowAnonymousFallback: true,
-    });
-    const auth = await registry.getAuthPull();
-    const newImage = this.getNewImageFullName(registry, container);
+    const runtimeContext = options.runtimeContext || {};
+    const dockerApi = runtimeContext.dockerApi || this.getWatcher(container)?.dockerApi;
+    let auth = runtimeContext.auth;
+    let newImage = runtimeContext.newImage;
+
+    if (!newImage || (!skipPull && auth === undefined)) {
+      const registry =
+        runtimeContext.registry ||
+        this.resolveRegistryManager(container, logContainer, {
+          allowAnonymousFallback: true,
+        });
+      if (!newImage) {
+        newImage = this.getNewImageFullName(registry, container);
+      }
+      if (!skipPull && auth === undefined) {
+        auth = await registry.getAuthPull();
+      }
+    }
     const currentContainer = await this.getCurrentContainer(dockerApi, container);
     if (!currentContainer) {
       throw new Error(
@@ -1592,8 +1712,9 @@ class Dockercompose extends Docker {
       );
     }
     const currentContainerSpec = await this.inspectContainer(currentContainer, logContainer);
+    this.ensureComposeRuntimeState(currentContainerSpec, composeFile, service);
     const serviceShouldStart =
-      shouldStart !== undefined ? shouldStart : currentContainerSpec?.State?.Running !== false;
+      shouldStart !== undefined ? shouldStart : currentContainerSpec.State.Running;
 
     logContainer.info(
       `Refresh compose service ${service} from ${composeFile} using Docker Engine API`,
@@ -1612,10 +1733,12 @@ class Dockercompose extends Docker {
     const recreationContainerSpec = {
       ...currentContainerSpec,
       State: {
-        ...currentContainerSpec?.State,
+        ...currentContainerSpec.State,
         Running: serviceShouldStart,
       },
     };
+    // Intentionally bypass Dockercompose.stopAndRemoveContainer() no-op: this
+    // internal Engine API refresh path must perform the real stop/remove.
     await super.stopAndRemoveContainer(
       currentContainer,
       currentContainerSpec,
@@ -1631,6 +1754,15 @@ class Dockercompose extends Docker {
     );
   }
 
+  /**
+   * No-op for generic callers that invoke stop/remove and recreate as two
+   * separate steps (for example health-monitor rollback paths). In compose
+   * mode, recreateContainer() owns the full mutation + runtime refresh and
+   * would otherwise duplicate stop/remove work.
+   *
+   * When a compose refresh must actually stop/remove, we bypass this override
+   * via super.stopAndRemoveContainer() in refreshComposeServiceWithDockerApi().
+   */
   async stopAndRemoveContainer(_currentContainer, _currentContainerSpec, container, logContainer) {
     logContainer.info(
       `Skip direct stop/remove for compose-managed container ${container.name}; using compose lifecycle`,
@@ -1671,17 +1803,17 @@ class Dockercompose extends Docker {
       shouldStart: currentContainerSpec?.State?.Running === true,
       skipPull: true,
       forceRecreate: true,
-    } as {
-      shouldStart: boolean;
-      skipPull: boolean;
-      forceRecreate: boolean;
-      composeFiles?: string[];
-    };
+    } as ComposeRuntimeRefreshOptions;
     if (composeFiles.length > 1) {
       composeUpdateOptions.composeFiles = composeFiles;
     }
 
-    await this.updateContainerWithCompose(composeFile, service, container, composeUpdateOptions);
+    await this.refreshComposeServiceWithDockerApi(
+      composeFile,
+      service,
+      container,
+      composeUpdateOptions,
+    );
   }
 
   async runServicePostStartHooks(container, serviceKey, service) {

From ee066ae1564a823a714d4c8e164688391c47fe14 Mon Sep 17 00:00:00 2001
From: superuserjr <80784472+turbodaemon@users.noreply.github.com>
Date: Mon, 9 Mar 2026 21:20:29 -0400
Subject: [PATCH 06/34] =?UTF-8?q?=F0=9F=93=9D=20docs(compose):=20replace?=
 =?UTF-8?q?=20CLI=20references=20with=20Engine=20API=20and=20add=20compose?=
 =?UTF-8?q?=20trigger=20support=20to=20actions?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 content/docs/current/configuration/actions/index.mdx   |  2 +-
 .../configuration/triggers/docker-compose/index.mdx    | 10 ++++++----
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/content/docs/current/configuration/actions/index.mdx b/content/docs/current/configuration/actions/index.mdx
index ffb29aad..d6dd7000 100644
--- a/content/docs/current/configuration/actions/index.mdx
+++ b/content/docs/current/configuration/actions/index.mdx
@@ -33,7 +33,7 @@ Container actions can be individually toggled with environment variables:
 
 ## Update action
 
-The update action triggers the Docker trigger for the selected container. It will:
+The update action triggers the Docker or Docker Compose trigger for the selected container. It will:
 
 1. Pull the latest image
 2. Backup the current image
diff --git a/content/docs/current/configuration/triggers/docker-compose/index.mdx b/content/docs/current/configuration/triggers/docker-compose/index.mdx
index d942db95..34e65e11 100644
--- a/content/docs/current/configuration/triggers/docker-compose/index.mdx
+++ b/content/docs/current/configuration/triggers/docker-compose/index.mdx
@@ -56,9 +56,11 @@ Most Docker Compose users do not need to configure the file path at all. As long
 
 <Callout type="warn">Do not forget to mount the docker-compose.yml file in the drydock container.</Callout>
 
+<Callout type="info">The Docker Compose trigger uses the Docker Engine API directly for all runtime operations (pull, stop, recreate). The `docker compose` / `docker-compose` CLI binary is **not required** inside the drydock container.</Callout>
+
 ## Tag vs digest updates
 
-For **tag-based updates**, the trigger patches the compose file with the new tag and then recreates the container. For **digest-only updates** (same tag, new digest), the compose file is left unchanged and only the container runtime is refreshed via `docker compose pull` + `docker compose up -d`.
+For **tag-based updates**, the trigger patches the compose file with the new tag and then recreates the container. For **digest-only updates** (same tag, new digest), the compose file is left unchanged and only the container runtime is refreshed (pull new image, stop/remove old container, recreate with new image).
 
 When `DIGESTPINNING=true`, compose mutations use digest references (`image@sha256:...`) when a digest is available.
 
@@ -72,7 +74,7 @@ When a tag-based update requires a compose file change, Drydock patches Compose
 
 <Callout type="info">If a service uses flow-style mapping without an `image` key (for example `nginx: { restart: always }`), Drydock will not auto-insert `image`. Convert that service to block-style YAML first.</Callout>
 
-Before persisting a compose mutation, Drydock validates the candidate file with `docker compose config --quiet` (and falls back to `docker-compose config --quiet` when needed). Invalid candidate configs are not written.
+Before persisting a compose mutation, Drydock validates the candidate file by parsing the full compose chain in-process. Invalid candidate configs are not written.
 
 ## Reconciliation behavior
 
@@ -84,7 +86,7 @@ Before lifecycle execution, Drydock checks the running container image against t
 
 ## Compose-file-once mode
 
-When `COMPOSEFILEONCE=true` and multiple services in the same compose stack/file require runtime refresh, Drydock executes one grouped compose pull/up pass for that stack and skips repeated per-service compose pull/up calls in that batch.
+When `COMPOSEFILEONCE=true` and multiple services in the same compose stack/file require runtime refresh, Drydock performs one runtime refresh per unique service and skips repeated refreshes for subsequent containers sharing the same service in that batch.
 
 ## Multi-file compose chains
 
@@ -94,7 +96,7 @@ During an update:
 
 1. Drydock searches every file in the chain to find which one declares the target service's `image` key.
 2. The last file in the chain that contains the service definition and is writable is selected as the update target. This matches Docker Compose override semantics where later files take precedence.
-3. All files in the chain are passed to `docker compose -f file1 -f file2 config --quiet` for validation before and after any mutation.
+3. All files in the chain are parsed in-process for validation before and after any mutation.
 
 The compose file chain for each container is visible in the container detail view of the UI.
 

From 9d22888457cfebebbbe1a507a8738a35cf1e6ba9 Mon Sep 17 00:00:00 2001
From: superuserjr <80784472+turbodaemon@users.noreply.github.com>
Date: Mon, 9 Mar 2026 21:20:34 -0400
Subject: [PATCH 07/34] =?UTF-8?q?=F0=9F=93=9D=20docs(oidc):=20mark=20DD=5F?=
 =?UTF-8?q?PUBLIC=5FURL=20as=20required=20and=20add=20to=20all=20examples?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../configuration/authentications/oidc/index.mdx   | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/content/docs/current/configuration/authentications/oidc/index.mdx b/content/docs/current/configuration/authentications/oidc/index.mdx
index 24858dea..0d94f690 100644
--- a/content/docs/current/configuration/authentications/oidc/index.mdx
+++ b/content/docs/current/configuration/authentications/oidc/index.mdx
@@ -20,11 +20,11 @@ The `oidc` authentication lets you protect drydock access using the [Openid Conn
 | `DD_AUTH_OIDC_{auth_name}_REDIRECT` | ⚪ | Skip internal login page & automatically redirect to the OIDC provider | `true`, `false` | `false` |
 | `DD_AUTH_OIDC_{auth_name}_LOGOUTURL` | ⚪ | Explicit IdP logout URL fallback when discovery metadata has no `end_session_endpoint` | URL | empty |
 | `DD_AUTH_OIDC_{auth_name}_TIMEOUT` | ⚪ | Timeout (in ms) when calling the OIDC provider | Minimum is 500 | `5000` |
+| `DD_PUBLIC_URL` | 🔴 | Public URL of your drydock instance (used to build the OIDC callback URL) | URL | |
 
-<Callout type="info">The callback URL (to configure in the IDP is built as `${drydock_public_url}/auth/oidc/${auth_name}/cb`</Callout>
+<Callout type="info">The callback URL (to configure in the IDP) is built as `${DD_PUBLIC_URL}/auth/oidc/${auth_name}/cb`</Callout>
 
-<Callout type="warn">drydock tries its best to determine the public address to forge redirections on its own.
-If it fails (irregular reverse proxy configuration...), you can enforce the value using the env var `DD_PUBLIC_URL`</Callout>
+<Callout type="warn">`DD_PUBLIC_URL` is **required** when OIDC is configured. Without it, the OIDC provider will fail to register at startup and the login page will show "No authentication methods configured". Check startup logs for the exact error.</Callout>
 
 <Callout type="info">If your IdP is on a different domain and callback fails with `OIDC session is missing or expired`, check `DD_SERVER_COOKIE_SAMESITE` (server config). Default is `lax` for OIDC compatibility; `strict` can break cross-site callbacks. Use `none` only for explicit cross-site/embed cases over HTTPS.</Callout>
 
@@ -88,6 +88,7 @@ services:
     image: codeswhat/drydock
     ...
     environment:
+      - DD_PUBLIC_URL=https://<your_drydock_public_domain>
       - DD_AUTH_OIDC_AUTHELIA_CLIENTID=my-drydock-client-id
       - DD_AUTH_OIDC_AUTHELIA_CLIENTSECRET=this-is-a-very-secure-secret
       - DD_AUTH_OIDC_AUTHELIA_DISCOVERY=https://<your_authelia_public_domain>/.well-known/openid-configuration
@@ -97,6 +98,7 @@ services:
 <Tab value="Docker (Authelia)">
 ```bash
 docker run \
+  -e DD_PUBLIC_URL="https://<your_drydock_public_domain>" \
   -e DD_AUTH_OIDC_AUTHELIA_CLIENTID="my-drydock-client-id" \
   -e DD_AUTH_OIDC_AUTHELIA_CLIENTSECRET="this-is-a-very-secure-secret" \
   -e DD_AUTH_OIDC_AUTHELIA_DISCOVERY="https://<your_authelia_public_domain>/.well-known/openid-configuration" \
@@ -129,6 +131,7 @@ services:
     image: codeswhat/drydock
     ...
     environment:
+      - DD_PUBLIC_URL=https://<your_drydock_public_domain>
       - DD_AUTH_OIDC_AUTH0_CLIENTID=<paste the Client ID from auth0 application settings>
       - DD_AUTH_OIDC_AUTH0_CLIENTSECRET=<paste the Client Secret from auth0 application settings>
       - DD_AUTH_OIDC_AUTH0_DISCOVERY=https://<paste the domain from auth0 application settings>/.well-known/openid-configuration
@@ -138,6 +141,7 @@ services:
 <Tab value="Docker (Auth0)">
 ```bash
 docker run \
+  -e DD_PUBLIC_URL="https://<your_drydock_public_domain>" \
   -e DD_AUTH_OIDC_AUTH0_CLIENTID="<paste the Client ID from auth0 application settings>" \
   -e DD_AUTH_OIDC_AUTH0_CLIENTSECRET="<paste the Client Secret from auth0 application settings>" \
   -e DD_AUTH_OIDC_AUTH0_DISCOVERY="https://<paste the domain from auth0 application settings>/.well-known/openid-configuration" \
@@ -182,6 +186,7 @@ services:
     image: codeswhat/drydock
     ...
     environment:
+      - DD_PUBLIC_URL=https://<your_drydock_public_domain>
       - DD_AUTH_OIDC_AUTHENTIK_CLIENTID=<paste the Client ID from authentik drydock_oidc provider>
       - DD_AUTH_OIDC_AUTHENTIK_CLIENTSECRET=<paste the Client Secret from authentik drydock_oidc provider>
       - DD_AUTH_OIDC_AUTHENTIK_DISCOVERY=<authentik_url>/application/o/<authentik_application_name>/.well-known/openid-configuration
@@ -192,6 +197,7 @@ services:
 <Tab value="Docker (Authentik)">
 ```bash
 docker run \
+  -e DD_PUBLIC_URL="https://<your_drydock_public_domain>" \
   -e DD_AUTH_OIDC_AUTHENTIK_CLIENTID="<paste the Client ID from authentik drydock_oidc provider>" \
   -e DD_AUTH_OIDC_AUTHENTIK_CLIENTSECRET="<paste the Client Secret from authentik drydock_oidc provider>" \
   -e DD_AUTH_OIDC_AUTHENTIK_DISCOVERY="<authentik_url>/application/o/<authentik_application_name>/.well-known/openid-configuration" \
@@ -217,6 +223,7 @@ services:
     image: codeswhat/drydock
     ...
     environment:
+      - DD_PUBLIC_URL=https://<your_drydock_public_domain>
       - DD_AUTH_OIDC_DEX_CLIENTID=<dex_client_id>
       - DD_AUTH_OIDC_DEX_CLIENTSECRET=<dex_client_secret>
       - DD_AUTH_OIDC_DEX_DISCOVERY=https://<your_dex_public_domain>/dex/.well-known/openid-configuration
@@ -228,6 +235,7 @@ services:
 <Tab value="Docker (Dex)">
 ```bash
 docker run \
+  -e DD_PUBLIC_URL="https://<your_drydock_public_domain>" \
   -e DD_AUTH_OIDC_DEX_CLIENTID="<dex_client_id>" \
   -e DD_AUTH_OIDC_DEX_CLIENTSECRET="<dex_client_secret>" \
   -e DD_AUTH_OIDC_DEX_DISCOVERY="https://<your_dex_public_domain>/dex/.well-known/openid-configuration" \

From 63a0db0734ee34fa5dd63eb62053cdcb7c52d2d7 Mon Sep 17 00:00:00 2001
From: superuserjr <80784472+turbodaemon@users.noreply.github.com>
Date: Mon, 9 Mar 2026 21:27:03 -0400
Subject: [PATCH 08/34] =?UTF-8?q?=E2=9C=85=20test(compose):=20add=20runtim?=
 =?UTF-8?q?e=20context=20passthrough=20and=20multi-file=20skipPull=20cover?=
 =?UTF-8?q?age?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../dockercompose/Dockercompose.test.ts       | 87 +++++++++++++++++++
 1 file changed, 87 insertions(+)

diff --git a/app/triggers/providers/dockercompose/Dockercompose.test.ts b/app/triggers/providers/dockercompose/Dockercompose.test.ts
index e11d2042..4ccf34eb 100644
--- a/app/triggers/providers/dockercompose/Dockercompose.test.ts
+++ b/app/triggers/providers/dockercompose/Dockercompose.test.ts
@@ -1389,6 +1389,36 @@ describe('Dockercompose Trigger', () => {
     );
   });
 
+  test('updateContainerWithCompose should fetch auth when runtime context provides newImage without auth', async () => {
+    trigger.configuration.dryrun = false;
+    const container = makeContainer({ name: 'nginx' });
+    const pullImageSpy = vi.spyOn(trigger, 'pullImage').mockResolvedValue();
+    const resolveRegistryManagerSpy = vi.spyOn(trigger, 'resolveRegistryManager');
+    const getNewImageFullNameSpy = vi.spyOn(trigger, 'getNewImageFullName');
+    const registryGetAuthPull = vi.fn().mockResolvedValue({ from: 'registry-auth' });
+    const runtimeContext = {
+      dockerApi: mockDockerApi,
+      newImage: 'nginx:9.9.9',
+      registry: {
+        getAuthPull: registryGetAuthPull,
+      },
+    };
+
+    await trigger.updateContainerWithCompose('/opt/drydock/test/stack.yml', 'nginx', container, {
+      runtimeContext,
+    });
+
+    expect(resolveRegistryManagerSpy).not.toHaveBeenCalled();
+    expect(getNewImageFullNameSpy).not.toHaveBeenCalled();
+    expect(registryGetAuthPull).toHaveBeenCalledTimes(1);
+    expect(pullImageSpy).toHaveBeenCalledWith(
+      runtimeContext.dockerApi,
+      { from: 'registry-auth' },
+      runtimeContext.newImage,
+      expect.anything(),
+    );
+  });
+
   test('updateContainerWithCompose should throw when current container cannot be resolved', async () => {
     trigger.configuration.dryrun = false;
     const container = makeContainer({ name: 'nginx' });
@@ -4670,6 +4700,63 @@ describe('Dockercompose Trigger', () => {
     );
   });
 
+  test('performContainerUpdate should pass skipPull in multi-file compose context', async () => {
+    trigger.configuration.dryrun = false;
+    const container = makeContainer({
+      name: 'nginx',
+    });
+    const updateContainerWithComposeSpy = vi
+      .spyOn(trigger, 'updateContainerWithCompose')
+      .mockResolvedValue();
+    vi.spyOn(trigger, 'runServicePostStartHooks').mockResolvedValue();
+
+    const updated = await trigger.performContainerUpdate({} as any, container as any, mockLog, {
+      composeFile: '/opt/drydock/test/stack.override.yml',
+      composeFiles: ['/opt/drydock/test/stack.yml', '/opt/drydock/test/stack.override.yml'],
+      service: 'nginx',
+      serviceDefinition: {},
+      composeFileOnceApplied: false,
+      skipPull: true,
+    } as any);
+
+    expect(updated).toBe(true);
+    expect(updateContainerWithComposeSpy).toHaveBeenCalledWith(
+      '/opt/drydock/test/stack.override.yml',
+      'nginx',
+      container,
+      {
+        composeFiles: ['/opt/drydock/test/stack.yml', '/opt/drydock/test/stack.override.yml'],
+        skipPull: true,
+      },
+    );
+  });
+
+  test('performContainerUpdate should avoid passing runtime context when none is available in single-file path', async () => {
+    trigger.configuration.dryrun = false;
+    const container = makeContainer({
+      name: 'nginx',
+    });
+    const updateContainerWithComposeSpy = vi
+      .spyOn(trigger, 'updateContainerWithCompose')
+      .mockResolvedValue();
+    vi.spyOn(trigger, 'runServicePostStartHooks').mockResolvedValue();
+
+    const updated = await trigger.performContainerUpdate({} as any, container as any, mockLog, {
+      composeFile: '/opt/drydock/test/stack.yml',
+      service: 'nginx',
+      serviceDefinition: {},
+      composeFileOnceApplied: false,
+    } as any);
+
+    expect(updated).toBe(true);
+    expect(updateContainerWithComposeSpy).toHaveBeenCalledWith(
+      '/opt/drydock/test/stack.yml',
+      'nginx',
+      container,
+      {},
+    );
+  });
+
   test('performContainerUpdate should skip per-service refresh when compose-file-once is already applied', async () => {
     trigger.configuration.dryrun = false;
     const container = makeContainer({

From 989cc230ae550c5c781ac4b9f217549d4b0f19ab Mon Sep 17 00:00:00 2001
From: superuserjr <80784472+turbodaemon@users.noreply.github.com>
Date: Mon, 9 Mar 2026 21:27:34 -0400
Subject: [PATCH 09/34] =?UTF-8?q?=F0=9F=93=9D=20docs(changelog):=20add=20c?=
 =?UTF-8?q?ompose=20refactor,=20composeFileOnce,=20and=20docs=20fixes?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 CHANGELOG.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5f36b5e1..6900f92c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -93,6 +93,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - **Compose trigger uses Docker Engine API** — Compose-managed container updates now use the Docker Engine API directly (pull, stop, recreate) instead of shelling out to `docker compose` / `docker-compose` CLI. Eliminates `spawn docker ENOENT` errors in environments without Docker CLI binaries installed.
 - **Compose self-update delegates to parent orchestrator** — Self-update for compose-managed Drydock containers now uses the parent Docker trigger's helper-container transition with health gates and rollback, instead of direct stop/recreate.
+- **Compose runtime refresh extracted** — Shared `refreshComposeServiceWithDockerApi()` helper eliminates the recursive `recreateContainer` → `updateContainerWithCompose` call chain. Both code paths now converge on the same explicit, non-recursive method.
+- **Compose-file-once batch mode re-enabled** — `COMPOSEFILEONCE=true` now works with the Docker Engine API runtime. First container per service gets a full runtime refresh; subsequent containers sharing the same service skip the refresh.
 - **Self-update controller testable entrypoint** — Extracted process-level entry logic to a separate entrypoint module, making the controller independently testable without triggering process-exit side effects.
 - **Dockercompose YAML patching simplified** — Removed redundant type guards and dead-code branches from compose file patching helpers, reducing code paths and improving maintainability.
 - **Dashboard fetches recent-status from backend** — Dashboard now fetches pre-computed container statuses from `/api/containers/recent-status` instead of scanning the raw audit log client-side.
@@ -122,6 +124,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - **Manual update button works with compose triggers** — The update container endpoint now searches for both `docker` and `dockercompose` trigger types, matching the existing preview endpoint behavior. Previously, users with only a compose trigger saw "No docker trigger found for this container".
 - **CI: qlty retry on timeout** — Changed `retry_on` from `error` to `any` so qlty timeouts trigger retries. Increased timeout from 5 to 8 minutes.
+- **OIDC docs clarified `DD_PUBLIC_URL` requirement** — OIDC documentation now explicitly marks `DD_PUBLIC_URL` as required and includes it in all provider example configurations (Authelia, Auth0, Authentik, Dex). Without this variable, the OIDC provider fails to register at startup.
+- **Compose trigger docs updated for Engine API** — Removed stale references to `docker compose config --quiet` CLI validation and `docker compose pull`/`up` commands. Docs now reflect in-process YAML validation and Docker Engine API runtime. Added callout that Docker Compose CLI is not required.
+- **Container actions docs updated for compose triggers** — Update action documentation now mentions both Docker and Docker Compose trigger support.
 - **Compose trigger rejects compose files mounted outside app directory** — Removed overly strict working-directory boundary enforcement from `runComposeCommand` that rejected compose files bind-mounted outside `/home/node/app`, breaking documented mount patterns like `/drydock/docker-compose.yml`. Compose file paths are operator-configured and already validated during resolution.
 - **Compose trigger uses host paths instead of container paths** — Docker label auto-detection (`com.docker.compose.project.config_files`) now remaps host-side paths to container-internal paths using Drydock's own bind mount information. Previously, host paths like `/mnt/volume1/docker/stacks/monitoring/compose.yaml` were used directly inside the container where they don't exist, causing "does not exist" errors even when the file was properly mounted.
 - **Compose trigger logs spurious warnings for unrelated containers** — When multiple compose triggers are configured, each trigger now silently skips containers whose resolved compose files don't match the trigger's configured `FILE` path, eliminating noisy cross-stack "does not exist" warnings.

From c8c48a0fa834e5929a82ad951bbbe744602a436e Mon Sep 17 00:00:00 2001
From: superuserjr <80784472+turbodaemon@users.noreply.github.com>
Date: Mon, 9 Mar 2026 21:48:33 -0400
Subject: [PATCH 10/34] =?UTF-8?q?=F0=9F=90=9B=20fix(ui):=20show=20loading?=
 =?UTF-8?q?=20state=20in=20confirm=20dialog=20during=20async=20actions?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Confirm dialog now awaits the async accept callback before closing,
showing a spinner and disabling all dismiss interactions while the
action runs. Previously the dialog closed immediately on confirm,
making the UI appear unresponsive during container actions.
---
 CHANGELOG.md                                  |   1 +
 ui/src/components/ConfirmDialog.vue           |  16 ++-
 ui/src/composables/useConfirmDialog.ts        |  36 +++++-
 ui/tests/components/ConfirmDialog.spec.ts     |  27 ++++
 ui/tests/composables/useConfirmDialog.spec.ts | 119 +++++++++++++++++-
 5 files changed, 187 insertions(+), 12 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6900f92c..e060cc4a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -122,6 +122,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- **Confirm dialog shows loading state during async actions** — Confirm dialog now awaits the async accept callback before closing, showing a spinner on the accept button and disabling all dismiss interactions (buttons, Escape, Enter, backdrop click) while the action runs. Previously, the dialog closed immediately on confirm, causing the UI to appear unresponsive until the action completed in the background.
 - **Manual update button works with compose triggers** — The update container endpoint now searches for both `docker` and `dockercompose` trigger types, matching the existing preview endpoint behavior. Previously, users with only a compose trigger saw "No docker trigger found for this container".
 - **CI: qlty retry on timeout** — Changed `retry_on` from `error` to `any` so qlty timeouts trigger retries. Increased timeout from 5 to 8 minutes.
 - **OIDC docs clarified `DD_PUBLIC_URL` requirement** — OIDC documentation now explicitly marks `DD_PUBLIC_URL` as required and includes it in all provider example configurations (Authelia, Auth0, Authentik, Dex). Without this variable, the OIDC provider fails to register at startup.
diff --git a/ui/src/components/ConfirmDialog.vue b/ui/src/components/ConfirmDialog.vue
index 417806d0..d5aeeca1 100644
--- a/ui/src/components/ConfirmDialog.vue
+++ b/ui/src/components/ConfirmDialog.vue
@@ -1,8 +1,9 @@
 <script setup lang="ts">
 import { onMounted, onUnmounted } from 'vue';
+import AppIcon from './AppIcon.vue';
 import { useConfirmDialog } from '../composables/useConfirmDialog';
 
-const { visible, current, accept, reject, dismiss } = useConfirmDialog();
+const { visible, current, loading, accept, reject, dismiss } = useConfirmDialog();
 const dialogTitleId = 'confirm-dialog-title';
 const dialogDescriptionId = 'confirm-dialog-description';
 
@@ -22,7 +23,7 @@ function isTextEntryTarget(target: EventTarget | null): boolean {
 }
 
 function handleKeydown(e: KeyboardEvent) {
-  if (!visible.value || !current.value) {
+  if (!visible.value || !current.value || loading.value) {
     return;
   }
   if (e.key === 'Escape') {
@@ -38,7 +39,7 @@ function handleKeydown(e: KeyboardEvent) {
     !isTextEntryTarget(e.target)
   ) {
     e.preventDefault();
-    accept();
+    void accept();
   }
 }
 
@@ -77,30 +78,37 @@ onUnmounted(() => globalThis.removeEventListener('keydown', handleKeydown));
           <div class="px-5 pt-3 pb-4.5 flex items-center justify-end gap-2.5">
             <button
               class="px-4 py-1.5 dd-rounded text-[11px] font-semibold transition-colors"
+              :disabled="loading"
               :aria-label="current.rejectLabel || 'Cancel'"
               :style="{
                 backgroundColor: 'var(--dd-bg-inset)',
                 border: '1px solid var(--dd-border-strong)',
                 color: 'var(--dd-text)',
+                opacity: loading ? '0.5' : '1',
+                cursor: loading ? 'not-allowed' : 'pointer',
               }"
               @click="reject">
               {{ current.rejectLabel || 'Cancel' }}
             </button>
             <button
-              class="px-4 py-1.5 dd-rounded text-[11px] font-semibold transition-colors"
+              class="px-4 py-1.5 dd-rounded text-[11px] font-semibold transition-colors flex items-center gap-1.5"
+              :disabled="loading"
               :aria-label="current.acceptLabel || 'Confirm'"
               :style="current.severity === 'danger'
                 ? {
                     backgroundColor: 'var(--dd-danger-muted)',
                     border: '1px solid var(--dd-danger)',
                     color: 'var(--dd-danger)',
+                    cursor: loading ? 'not-allowed' : 'pointer',
                   }
                 : {
                     backgroundColor: 'var(--dd-warning-muted)',
                     border: '1px solid var(--dd-warning)',
                     color: 'var(--dd-warning)',
+                    cursor: loading ? 'not-allowed' : 'pointer',
                   }"
               @click="accept">
+              <AppIcon v-if="loading" name="restart" :size="11" class="animate-spin" />
               {{ current.acceptLabel || 'Confirm' }}
             </button>
           </div>
diff --git a/ui/src/composables/useConfirmDialog.ts b/ui/src/composables/useConfirmDialog.ts
index 114700a3..16c177de 100644
--- a/ui/src/composables/useConfirmDialog.ts
+++ b/ui/src/composables/useConfirmDialog.ts
@@ -6,35 +6,59 @@ interface ConfirmOptions {
   acceptLabel?: string;
   rejectLabel?: string;
   severity?: 'danger' | 'warn';
-  accept?: () => void;
+  accept?: () => void | Promise<void>;
   reject?: () => void;
 }
 
 const visible = ref(false);
 const current = ref<ConfirmOptions | null>(null);
+const loading = ref(false);
 
 export function useConfirmDialog() {
   function require(opts: ConfirmOptions) {
     current.value = opts;
     visible.value = true;
+    loading.value = false;
   }
 
-  function accept() {
-    current.value?.accept?.();
-    visible.value = false;
-    current.value = null;
+  async function accept() {
+    if (loading.value) {
+      return;
+    }
+    const callback = current.value?.accept;
+    if (!callback) {
+      visible.value = false;
+      current.value = null;
+      return;
+    }
+    loading.value = true;
+    try {
+      await callback();
+    } catch {
+      // Callback is responsible for its own error handling.
+    } finally {
+      loading.value = false;
+      visible.value = false;
+      current.value = null;
+    }
   }
 
   function reject() {
+    if (loading.value) {
+      return;
+    }
     current.value?.reject?.();
     visible.value = false;
     current.value = null;
   }
 
   function dismiss() {
+    if (loading.value) {
+      return;
+    }
     visible.value = false;
     current.value = null;
   }
 
-  return { visible, current, require, accept, reject, dismiss };
+  return { visible, current, loading, require, accept, reject, dismiss };
 }
diff --git a/ui/tests/components/ConfirmDialog.spec.ts b/ui/tests/components/ConfirmDialog.spec.ts
index 1bb320eb..abdb1934 100644
--- a/ui/tests/components/ConfirmDialog.spec.ts
+++ b/ui/tests/components/ConfirmDialog.spec.ts
@@ -4,6 +4,7 @@ import ConfirmDialog from '@/components/ConfirmDialog.vue';
 
 const visible = ref(false);
 const current = ref<any>(null);
+const loading = ref(false);
 const accept = vi.fn();
 const reject = vi.fn();
 const dismiss = vi.fn();
@@ -12,6 +13,7 @@ vi.mock('@/composables/useConfirmDialog', () => ({
   useConfirmDialog: () => ({
     visible,
     current,
+    loading,
     accept,
     reject,
     dismiss,
@@ -32,6 +34,7 @@ describe('ConfirmDialog', () => {
   beforeEach(() => {
     visible.value = false;
     current.value = null;
+    loading.value = false;
     accept.mockClear();
     reject.mockClear();
     dismiss.mockClear();
@@ -75,6 +78,30 @@ describe('ConfirmDialog', () => {
     wrapper.unmount();
   });
 
+  it('blocks Escape during loading', async () => {
+    const wrapper = mount(ConfirmDialog);
+    showDialog();
+    loading.value = true;
+    await nextTick();
+
+    globalThis.dispatchEvent(new KeyboardEvent('keydown', { key: 'Escape' }));
+    expect(dismiss).not.toHaveBeenCalled();
+
+    wrapper.unmount();
+  });
+
+  it('blocks Enter during loading', async () => {
+    const wrapper = mount(ConfirmDialog);
+    showDialog();
+    loading.value = true;
+    await nextTick();
+
+    globalThis.dispatchEvent(new KeyboardEvent('keydown', { key: 'Enter' }));
+    expect(accept).not.toHaveBeenCalled();
+
+    wrapper.unmount();
+  });
+
   it('renders dialog semantics when visible', async () => {
     const wrapper = mount(ConfirmDialog);
     showDialog();
diff --git a/ui/tests/composables/useConfirmDialog.spec.ts b/ui/tests/composables/useConfirmDialog.spec.ts
index 7da76f2a..cd88a19a 100644
--- a/ui/tests/composables/useConfirmDialog.spec.ts
+++ b/ui/tests/composables/useConfirmDialog.spec.ts
@@ -48,7 +48,7 @@ describe('useConfirmDialog', () => {
       reject: onReject,
     });
 
-    dialog.accept();
+    await dialog.accept();
 
     expect(onAccept).toHaveBeenCalledTimes(1);
     expect(onReject).not.toHaveBeenCalled();
@@ -56,6 +56,121 @@ describe('useConfirmDialog', () => {
     expect(dialog.current.value).toBeNull();
   });
 
+  it('accept awaits async callback before closing', async () => {
+    const useConfirmDialog = await loadComposable();
+    const dialog = useConfirmDialog();
+    let resolved = false;
+    const asyncCallback = vi.fn(
+      () =>
+        new Promise<void>((resolve) => {
+          setTimeout(() => {
+            resolved = true;
+            resolve();
+          }, 50);
+        }),
+    );
+
+    dialog.require({
+      header: 'Stop Container',
+      message: 'Stop nginx?',
+      accept: asyncCallback,
+    });
+
+    const acceptPromise = dialog.accept();
+
+    expect(dialog.loading.value).toBe(true);
+    expect(dialog.visible.value).toBe(true);
+
+    await acceptPromise;
+
+    expect(resolved).toBe(true);
+    expect(dialog.loading.value).toBe(false);
+    expect(dialog.visible.value).toBe(false);
+    expect(dialog.current.value).toBeNull();
+  });
+
+  it('blocks reject and dismiss while loading', async () => {
+    const useConfirmDialog = await loadComposable();
+    const dialog = useConfirmDialog();
+    const onReject = vi.fn();
+    let resolveCallback: () => void;
+    const asyncCallback = () =>
+      new Promise<void>((resolve) => {
+        resolveCallback = resolve;
+      });
+
+    dialog.require({
+      header: 'Stop Container',
+      message: 'Stop nginx?',
+      accept: asyncCallback,
+      reject: onReject,
+    });
+
+    const acceptPromise = dialog.accept();
+    expect(dialog.loading.value).toBe(true);
+
+    dialog.reject();
+    expect(onReject).not.toHaveBeenCalled();
+    expect(dialog.visible.value).toBe(true);
+
+    dialog.dismiss();
+    expect(dialog.visible.value).toBe(true);
+
+    resolveCallback!();
+    await acceptPromise;
+
+    expect(dialog.loading.value).toBe(false);
+    expect(dialog.visible.value).toBe(false);
+  });
+
+  it('blocks duplicate accept calls while loading', async () => {
+    const useConfirmDialog = await loadComposable();
+    const dialog = useConfirmDialog();
+    let callCount = 0;
+    let resolveCallback: () => void;
+    const asyncCallback = vi.fn(
+      () =>
+        new Promise<void>((resolve) => {
+          callCount++;
+          resolveCallback = resolve;
+        }),
+    );
+
+    dialog.require({
+      header: 'Restart',
+      message: 'Restart container?',
+      accept: asyncCallback,
+    });
+
+    const firstAccept = dialog.accept();
+    void dialog.accept();
+
+    expect(asyncCallback).toHaveBeenCalledTimes(1);
+
+    resolveCallback!();
+    await firstAccept;
+
+    expect(callCount).toBe(1);
+  });
+
+  it('clears loading on callback error', async () => {
+    const useConfirmDialog = await loadComposable();
+    const dialog = useConfirmDialog();
+    const failingCallback = vi.fn(() => Promise.reject(new Error('API failed')));
+
+    dialog.require({
+      header: 'Update',
+      message: 'Update container?',
+      accept: failingCallback,
+    });
+
+    await dialog.accept();
+
+    expect(dialog.loading.value).toBe(false);
+    expect(dialog.visible.value).toBe(false);
+    expect(dialog.current.value).toBeNull();
+  });
+
   it('reject invokes reject callback and clears state', async () => {
     const useConfirmDialog = await loadComposable();
     const dialog = useConfirmDialog();
@@ -106,7 +221,7 @@ describe('useConfirmDialog', () => {
       header: 'Delete server',
       message: 'No callbacks',
     });
-    expect(() => dialog.accept()).not.toThrow();
+    await expect(dialog.accept()).resolves.toBeUndefined();
     expect(dialog.visible.value).toBe(false);
     expect(dialog.current.value).toBeNull();
 

From 79c60b80fe34e0e3a83e0a1085967f6dc4202e6b Mon Sep 17 00:00:00 2001
From: superuserjr <80784472+turbodaemon@users.noreply.github.com>
Date: Mon, 9 Mar 2026 22:14:45 -0400
Subject: [PATCH 11/34] =?UTF-8?q?=E2=9C=A8=20feat(ui):=20disable=20action?=
 =?UTF-8?q?=20buttons=20and=20show=20spinner=20during=20in-progress=20acti?=
 =?UTF-8?q?ons?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Wire actionInProgress into disabled state for all container action buttons
  across full-page detail, side panel, and grouped views (table/card/list)
- Add aria-label attributes to full-page detail action buttons
- Show spinner icon replacing normal icon on active action button
- Add opacity-50 + cursor-not-allowed styling when disabled
- Add tests for disabled state and aria-labels
---
 .../containers/ContainerFullPageDetail.vue    | 35 +++++++---
 .../containers/ContainerSideDetail.vue        | 25 +++++--
 .../containers/ContainersGroupedViews.vue     | 58 +++++++++++++----
 .../ContainerFullPageDetail.spec.ts           | 65 +++++++++++++++++++
 4 files changed, 155 insertions(+), 28 deletions(-)

diff --git a/ui/src/components/containers/ContainerFullPageDetail.vue b/ui/src/components/containers/ContainerFullPageDetail.vue
index dcb85fd0..f1f7b637 100644
--- a/ui/src/components/containers/ContainerFullPageDetail.vue
+++ b/ui/src/components/containers/ContainerFullPageDetail.vue
@@ -11,6 +11,7 @@ const {
   scanContainer,
   confirmUpdate,
   confirmDelete,
+  actionInProgress,
   registryColorBg,
   registryColorText,
   registryLabel,
@@ -91,46 +92,64 @@ const {
           <button
             v-if="selectedContainer.status === 'running'"
             class="flex items-center gap-1.5 px-3 py-1.5 dd-rounded text-[11px] font-semibold transition-colors"
+            :class="actionInProgress === selectedContainer.name ? 'opacity-50 cursor-not-allowed' : ''"
             :style="{ backgroundColor: 'var(--dd-danger-muted)', color: 'var(--dd-danger)', border: '1px solid var(--dd-danger)' }"
+            :disabled="actionInProgress === selectedContainer.name"
+            aria-label="Stop container"
             @click="confirmStop(selectedContainer.name)">
-            <AppIcon name="stop" :size="12" />
+            <AppIcon :name="actionInProgress === selectedContainer.name ? 'spinner' : 'stop'" :size="12" :class="actionInProgress === selectedContainer.name ? 'dd-spin' : ''" />
             Stop
           </button>
           <button
             v-else
             class="flex items-center gap-1.5 px-3 py-1.5 dd-rounded text-[11px] font-semibold transition-colors"
+            :class="actionInProgress === selectedContainer.name ? 'opacity-50 cursor-not-allowed' : ''"
             :style="{ backgroundColor: 'var(--dd-success-muted)', color: 'var(--dd-success)', border: '1px solid var(--dd-success)' }"
+            :disabled="actionInProgress === selectedContainer.name"
+            aria-label="Start container"
             @click="startContainer(selectedContainer.name)">
-            <AppIcon name="play" :size="12" />
+            <AppIcon :name="actionInProgress === selectedContainer.name ? 'spinner' : 'play'" :size="12" :class="actionInProgress === selectedContainer.name ? 'dd-spin' : ''" />
             Start
           </button>
           <button
-            class="flex items-center gap-1.5 px-3 py-1.5 dd-rounded text-[11px] font-semibold transition-colors dd-text-muted hover:dd-text"
+            class="flex items-center gap-1.5 px-3 py-1.5 dd-rounded text-[11px] font-semibold transition-colors"
+            :class="actionInProgress === selectedContainer.name ? 'opacity-50 cursor-not-allowed' : 'dd-text-muted hover:dd-text'"
             :style="{ border: '1px solid var(--dd-border-strong)' }"
+            :disabled="actionInProgress === selectedContainer.name"
+            aria-label="Restart container"
             @click="confirmRestart(selectedContainer.name)">
-            <AppIcon name="restart" :size="12" />
+            <AppIcon :name="actionInProgress === selectedContainer.name ? 'spinner' : 'restart'" :size="12" :class="actionInProgress === selectedContainer.name ? 'dd-spin' : ''" />
             Restart
           </button>
           <button
-            class="flex items-center gap-1.5 px-3 py-1.5 dd-rounded text-[11px] font-semibold transition-colors dd-text-muted hover:dd-text"
+            class="flex items-center gap-1.5 px-3 py-1.5 dd-rounded text-[11px] font-semibold transition-colors"
+            :class="actionInProgress === selectedContainer.name ? 'opacity-50 cursor-not-allowed' : 'dd-text-muted hover:dd-text'"
             :style="{ border: '1px solid var(--dd-border-strong)' }"
+            :disabled="actionInProgress === selectedContainer.name"
+            aria-label="Scan container"
             @click="scanContainer(selectedContainer.name)">
-            <AppIcon name="security" :size="12" />
+            <AppIcon :name="actionInProgress === selectedContainer.name ? 'spinner' : 'security'" :size="12" :class="actionInProgress === selectedContainer.name ? 'dd-spin' : ''" />
             Scan
           </button>
           <button
             v-if="selectedContainer.newTag"
             class="flex items-center gap-1.5 px-3 py-1.5 dd-rounded text-[11px] font-bold transition-colors"
+            :class="actionInProgress === selectedContainer.name ? 'opacity-50 cursor-not-allowed' : ''"
             :style="{ backgroundColor: 'var(--dd-success-muted)', color: 'var(--dd-success)', border: '1px solid var(--dd-success)' }"
+            :disabled="actionInProgress === selectedContainer.name"
+            aria-label="Update container"
             @click="confirmUpdate(selectedContainer.name)">
-            <AppIcon name="cloud-download" :size="12" />
+            <AppIcon :name="actionInProgress === selectedContainer.name ? 'spinner' : 'cloud-download'" :size="12" :class="actionInProgress === selectedContainer.name ? 'dd-spin' : ''" />
             Update
           </button>
           <button
             class="flex items-center gap-1.5 px-3 py-1.5 dd-rounded text-[11px] font-semibold transition-colors"
+            :class="actionInProgress === selectedContainer.name ? 'opacity-50 cursor-not-allowed' : ''"
             :style="{ backgroundColor: 'var(--dd-danger-muted)', color: 'var(--dd-danger)', border: '1px solid var(--dd-danger)' }"
+            :disabled="actionInProgress === selectedContainer.name"
+            aria-label="Delete container"
             @click="confirmDelete(selectedContainer.name)">
-            <AppIcon name="trash" :size="12" />
+            <AppIcon :name="actionInProgress === selectedContainer.name ? 'spinner' : 'trash'" :size="12" :class="actionInProgress === selectedContainer.name ? 'dd-spin' : ''" />
             Delete
           </button>
         </div>
diff --git a/ui/src/components/containers/ContainerSideDetail.vue b/ui/src/components/containers/ContainerSideDetail.vue
index 06fe0373..866c3dbc 100644
--- a/ui/src/components/containers/ContainerSideDetail.vue
+++ b/ui/src/components/containers/ContainerSideDetail.vue
@@ -11,6 +11,7 @@ const {
   openFullPage,
   detailTabs,
   activeDetailTab,
+  actionInProgress,
   confirmStop,
   startContainer,
   confirmRestart,
@@ -37,39 +38,51 @@ const {
         <div class="flex items-center gap-0.5">
           <button
             v-if="selectedContainer.status === 'running'"
-            class="w-7 h-7 dd-rounded flex items-center justify-center transition-[color,background-color,border-color,opacity,transform,box-shadow] dd-text-muted hover:dd-text-danger hover:dd-bg-hover hover:scale-110 active:scale-95"
+            class="w-7 h-7 dd-rounded flex items-center justify-center transition-[color,background-color,border-color,opacity,transform,box-shadow]"
+            :class="actionInProgress === selectedContainer.name ? 'dd-text-muted opacity-50 cursor-not-allowed' : 'dd-text-muted hover:dd-text-danger hover:dd-bg-hover hover:scale-110 active:scale-95'"
+            :disabled="actionInProgress === selectedContainer.name"
             v-tooltip.top="tt('Stop')"
             @click="confirmStop(selectedContainer.name)">
             <AppIcon name="stop" :size="12" />
           </button>
           <button
             v-else
-            class="w-7 h-7 dd-rounded flex items-center justify-center transition-[color,background-color,border-color,opacity,transform,box-shadow] dd-text-muted hover:dd-text-success hover:dd-bg-hover hover:scale-110 active:scale-95"
+            class="w-7 h-7 dd-rounded flex items-center justify-center transition-[color,background-color,border-color,opacity,transform,box-shadow]"
+            :class="actionInProgress === selectedContainer.name ? 'dd-text-muted opacity-50 cursor-not-allowed' : 'dd-text-muted hover:dd-text-success hover:dd-bg-hover hover:scale-110 active:scale-95'"
+            :disabled="actionInProgress === selectedContainer.name"
             v-tooltip.top="tt('Start')"
             @click="startContainer(selectedContainer.name)">
             <AppIcon name="play" :size="12" />
           </button>
           <button
-            class="w-7 h-7 dd-rounded flex items-center justify-center transition-[color,background-color,border-color,opacity,transform,box-shadow] dd-text-muted hover:dd-text hover:dd-bg-hover hover:scale-110 active:scale-95"
+            class="w-7 h-7 dd-rounded flex items-center justify-center transition-[color,background-color,border-color,opacity,transform,box-shadow]"
+            :class="actionInProgress === selectedContainer.name ? 'dd-text-muted opacity-50 cursor-not-allowed' : 'dd-text-muted hover:dd-text hover:dd-bg-hover hover:scale-110 active:scale-95'"
+            :disabled="actionInProgress === selectedContainer.name"
             v-tooltip.top="tt('Restart')"
             @click="confirmRestart(selectedContainer.name)">
             <AppIcon name="restart" :size="12" />
           </button>
           <button
-            class="w-7 h-7 dd-rounded flex items-center justify-center transition-[color,background-color,border-color,opacity,transform,box-shadow] dd-text-muted hover:dd-text-secondary hover:dd-bg-hover hover:scale-110 active:scale-95"
+            class="w-7 h-7 dd-rounded flex items-center justify-center transition-[color,background-color,border-color,opacity,transform,box-shadow]"
+            :class="actionInProgress === selectedContainer.name ? 'dd-text-muted opacity-50 cursor-not-allowed' : 'dd-text-muted hover:dd-text-secondary hover:dd-bg-hover hover:scale-110 active:scale-95'"
+            :disabled="actionInProgress === selectedContainer.name"
             v-tooltip.top="tt('Scan')"
             @click="scanContainer(selectedContainer.name)">
             <AppIcon name="security" :size="12" />
           </button>
           <button
             v-if="selectedContainer.newTag"
-            class="w-7 h-7 dd-rounded flex items-center justify-center transition-[color,background-color,border-color,opacity,transform,box-shadow] dd-text-muted hover:dd-text-success hover:dd-bg-hover hover:scale-110 active:scale-95"
+            class="w-7 h-7 dd-rounded flex items-center justify-center transition-[color,background-color,border-color,opacity,transform,box-shadow]"
+            :class="actionInProgress === selectedContainer.name ? 'dd-text-muted opacity-50 cursor-not-allowed' : 'dd-text-muted hover:dd-text-success hover:dd-bg-hover hover:scale-110 active:scale-95'"
+            :disabled="actionInProgress === selectedContainer.name"
             v-tooltip.top="tt('Update')"
             @click="confirmUpdate(selectedContainer.name)">
             <AppIcon name="cloud-download" :size="14" />
           </button>
           <button
-            class="w-7 h-7 dd-rounded flex items-center justify-center transition-[color,background-color,border-color,opacity,transform,box-shadow] dd-text-muted hover:dd-text-danger hover:dd-bg-hover hover:scale-110 active:scale-95"
+            class="w-7 h-7 dd-rounded flex items-center justify-center transition-[color,background-color,border-color,opacity,transform,box-shadow]"
+            :class="actionInProgress === selectedContainer.name ? 'dd-text-muted opacity-50 cursor-not-allowed' : 'dd-text-muted hover:dd-text-danger hover:dd-bg-hover hover:scale-110 active:scale-95'"
+            :disabled="actionInProgress === selectedContainer.name"
             v-tooltip.top="tt('Delete')"
             @click="confirmDelete(selectedContainer.name)">
             <AppIcon name="trash" :size="12" />
diff --git a/ui/src/components/containers/ContainersGroupedViews.vue b/ui/src/components/containers/ContainersGroupedViews.vue
index 5c953224..a3fbde62 100644
--- a/ui/src/components/containers/ContainersGroupedViews.vue
+++ b/ui/src/components/containers/ContainersGroupedViews.vue
@@ -303,22 +303,32 @@ const {
                 <AppIcon name="lock" :size="13" />
               </button>
               <button v-else-if="c.newTag"
-                      class="w-8 h-8 dd-rounded flex items-center justify-center transition-[color,background-color,border-color,opacity,transform,box-shadow] dd-text-muted hover:dd-text-success hover:dd-bg-hover hover:scale-110 active:scale-95"
+                      class="w-8 h-8 dd-rounded flex items-center justify-center transition-[color,background-color,border-color,opacity,transform,box-shadow]"
+                      :class="actionInProgress === c.name ? 'dd-text-muted opacity-50 cursor-not-allowed' : 'dd-text-muted hover:dd-text-success hover:dd-bg-hover hover:scale-110 active:scale-95'"
+                      :disabled="actionInProgress === c.name"
                       v-tooltip.top="tt('Update')" @click.stop="confirmUpdate(c.name)">
                 <AppIcon name="cloud-download" :size="16" />
               </button>
               <button v-else-if="c.status === 'running'"
-                      class="w-8 h-8 dd-rounded flex items-center justify-center transition-[color,background-color,border-color,opacity,transform,box-shadow] dd-text-muted hover:dd-text-danger hover:dd-bg-hover hover:scale-110 active:scale-95"
+                      class="w-8 h-8 dd-rounded flex items-center justify-center transition-[color,background-color,border-color,opacity,transform,box-shadow]"
+                      :class="actionInProgress === c.name ? 'dd-text-muted opacity-50 cursor-not-allowed' : 'dd-text-muted hover:dd-text-danger hover:dd-bg-hover hover:scale-110 active:scale-95'"
+                      :disabled="actionInProgress === c.name"
                       v-tooltip.top="tt('Stop')" @click.stop="confirmStop(c.name)">
                 <AppIcon name="stop" :size="14" />
               </button>
               <button v-else
-                      class="w-8 h-8 dd-rounded flex items-center justify-center transition-[color,background-color,border-color,opacity,transform,box-shadow] dd-text-muted hover:dd-text-success hover:dd-bg-hover hover:scale-110 active:scale-95"
+                      class="w-8 h-8 dd-rounded flex items-center justify-center transition-[color,background-color,border-color,opacity,transform,box-shadow]"
+                      :class="actionInProgress === c.name ? 'dd-text-muted opacity-50 cursor-not-allowed' : 'dd-text-muted hover:dd-text-success hover:dd-bg-hover hover:scale-110 active:scale-95'"
+                      :disabled="actionInProgress === c.name"
                       v-tooltip.top="tt('Start')" @click.stop="startContainer(c.name)">
                 <AppIcon name="play" :size="14" />
               </button>
-              <button class="w-8 h-8 dd-rounded flex items-center justify-center transition-[color,background-color,border-color,opacity,transform,box-shadow] dd-text-muted hover:dd-text hover:dd-bg-hover hover:scale-110 active:scale-95"
-                      :class="openActionsMenu === c.name ? 'dd-bg-elevated dd-text' : ''"
+              <button class="w-8 h-8 dd-rounded flex items-center justify-center transition-[color,background-color,border-color,opacity,transform,box-shadow]"
+                      :class="[
+                        actionInProgress === c.name ? 'dd-text-muted opacity-50 cursor-not-allowed' : 'dd-text-muted hover:dd-text hover:dd-bg-hover hover:scale-110 active:scale-95',
+                        openActionsMenu === c.name && actionInProgress !== c.name ? 'dd-bg-elevated dd-text' : '',
+                      ]"
+                      :disabled="actionInProgress === c.name"
                       v-tooltip.top="tt('More')" @click.stop="toggleActionsMenu(c.name, $event)">
                 <AppIcon name="more" :size="13" />
               </button>
@@ -343,15 +353,19 @@ const {
               </div>
               <!-- Updatable: split button -->
               <div v-else class="inline-flex dd-rounded overflow-hidden"
+                   :class="actionInProgress === c.name ? 'opacity-50' : ''"
                    :style="{ border: '1px solid var(--dd-success)' }">
                 <button class="inline-flex items-center justify-center whitespace-nowrap px-3 py-1.5 text-[11px] font-bold tracking-wide transition-colors"
+                        :class="actionInProgress === c.name ? 'cursor-not-allowed' : ''"
                         :style="{ backgroundColor: 'var(--dd-success-muted)', color: 'var(--dd-success)' }"
+                        :disabled="actionInProgress === c.name"
                         @click.stop="confirmUpdate(c.name)">
                   <AppIcon name="cloud-download" :size="11" class="mr-1" /> Update
                 </button>
                 <button class="inline-flex items-center justify-center w-7 transition-colors"
+                        :class="actionInProgress === c.name ? 'cursor-not-allowed' : openActionsMenu === c.name ? 'brightness-125' : ''"
                         :style="{ backgroundColor: 'var(--dd-success-muted)', color: 'var(--dd-success)', borderLeft: '1px solid var(--dd-success)' }"
-                        :class="openActionsMenu === c.name ? 'brightness-125' : ''"
+                        :disabled="actionInProgress === c.name"
                         @click.stop="toggleActionsMenu(c.name, $event)">
                   <AppIcon name="chevron-down" :size="11" />
                 </button>
@@ -359,16 +373,22 @@ const {
             </div>
             <div v-else class="flex items-center justify-end gap-1">
               <button v-if="c.status === 'running'"
-                      class="w-6 h-6 dd-rounded-sm flex items-center justify-center transition-colors dd-text-muted hover:dd-text-danger hover:dd-bg-hover"
+                      class="w-6 h-6 dd-rounded-sm flex items-center justify-center transition-colors"
+                      :class="actionInProgress === c.name ? 'dd-text-muted opacity-50 cursor-not-allowed' : 'dd-text-muted hover:dd-text-danger hover:dd-bg-hover'"
+                      :disabled="actionInProgress === c.name"
                       v-tooltip.top="tt('Stop')" @click.stop="confirmStop(c.name)">
                 <AppIcon name="stop" :size="11" />
               </button>
               <button v-else
-                      class="w-6 h-6 dd-rounded-sm flex items-center justify-center transition-colors dd-text-muted hover:dd-text-success hover:dd-bg-hover"
+                      class="w-6 h-6 dd-rounded-sm flex items-center justify-center transition-colors"
+                      :class="actionInProgress === c.name ? 'dd-text-muted opacity-50 cursor-not-allowed' : 'dd-text-muted hover:dd-text-success hover:dd-bg-hover'"
+                      :disabled="actionInProgress === c.name"
                       v-tooltip.top="tt('Start')" @click.stop="startContainer(c.name)">
                 <AppIcon name="play" :size="11" />
               </button>
-              <button class="w-6 h-6 dd-rounded-sm flex items-center justify-center transition-colors dd-text-muted hover:dd-text hover:dd-bg-hover"
+              <button class="w-6 h-6 dd-rounded-sm flex items-center justify-center transition-colors"
+                      :class="actionInProgress === c.name ? 'dd-text-muted opacity-50 cursor-not-allowed' : 'dd-text-muted hover:dd-text hover:dd-bg-hover'"
+                      :disabled="actionInProgress === c.name"
                       v-tooltip.top="tt('Restart')" @click.stop="confirmRestart(c.name)">
                 <AppIcon name="restart" :size="11" />
               </button>
@@ -556,25 +576,35 @@ const {
             <div class="flex items-center gap-1.5">
               <template v-if="containerActionsEnabled">
                 <button v-if="c.status === 'running'"
-                        class="w-7 h-7 dd-rounded-sm flex items-center justify-center transition-colors dd-text-muted hover:dd-text-danger hover:dd-bg-elevated"
+                        class="w-7 h-7 dd-rounded-sm flex items-center justify-center transition-colors"
+                        :class="actionInProgress === c.name ? 'dd-text-muted opacity-50 cursor-not-allowed' : 'dd-text-muted hover:dd-text-danger hover:dd-bg-elevated'"
+                        :disabled="actionInProgress === c.name"
                         v-tooltip.top="tt('Stop')" @click.stop="confirmStop(c.name)">
                   <AppIcon name="stop" :size="14" />
                 </button>
                 <button v-else
-                        class="w-7 h-7 dd-rounded-sm flex items-center justify-center transition-colors dd-text-muted hover:dd-text-success hover:dd-bg-elevated"
+                        class="w-7 h-7 dd-rounded-sm flex items-center justify-center transition-colors"
+                        :class="actionInProgress === c.name ? 'dd-text-muted opacity-50 cursor-not-allowed' : 'dd-text-muted hover:dd-text-success hover:dd-bg-elevated'"
+                        :disabled="actionInProgress === c.name"
                         v-tooltip.top="tt('Start')" @click.stop="startContainer(c.name)">
                   <AppIcon name="play" :size="14" />
                 </button>
-                <button class="w-7 h-7 dd-rounded-sm flex items-center justify-center transition-colors dd-text-muted hover:dd-text hover:dd-bg-elevated"
+                <button class="w-7 h-7 dd-rounded-sm flex items-center justify-center transition-colors"
+                        :class="actionInProgress === c.name ? 'dd-text-muted opacity-50 cursor-not-allowed' : 'dd-text-muted hover:dd-text hover:dd-bg-elevated'"
+                        :disabled="actionInProgress === c.name"
                         v-tooltip.top="tt('Restart')" @click.stop="confirmRestart(c.name)">
                   <AppIcon name="restart" :size="14" />
                 </button>
-                <button class="w-7 h-7 dd-rounded-sm flex items-center justify-center transition-colors dd-text-muted hover:dd-text-secondary hover:dd-bg-elevated"
+                <button class="w-7 h-7 dd-rounded-sm flex items-center justify-center transition-colors"
+                        :class="actionInProgress === c.name ? 'dd-text-muted opacity-50 cursor-not-allowed' : 'dd-text-muted hover:dd-text-secondary hover:dd-bg-elevated'"
+                        :disabled="actionInProgress === c.name"
                         v-tooltip.top="tt('Scan')" @click.stop="scanContainer(c.name)">
                   <AppIcon name="security" :size="14" />
                 </button>
                 <button v-if="c.newTag"
-                        class="w-7 h-7 dd-rounded-sm flex items-center justify-center transition-colors dd-text-muted hover:dd-text-success hover:dd-bg-elevated"
+                        class="w-7 h-7 dd-rounded-sm flex items-center justify-center transition-colors"
+                        :class="actionInProgress === c.name ? 'dd-text-muted opacity-50 cursor-not-allowed' : 'dd-text-muted hover:dd-text-success hover:dd-bg-elevated'"
+                        :disabled="actionInProgress === c.name"
                         v-tooltip.top="tt('Update')" @click.stop="confirmUpdate(c.name)">
                   <AppIcon name="cloud-download" :size="14" />
                 </button>
diff --git a/ui/tests/components/containers/ContainerFullPageDetail.spec.ts b/ui/tests/components/containers/ContainerFullPageDetail.spec.ts
index 1210b153..a6e135e9 100644
--- a/ui/tests/components/containers/ContainerFullPageDetail.spec.ts
+++ b/ui/tests/components/containers/ContainerFullPageDetail.spec.ts
@@ -16,6 +16,7 @@ const selectedContainer = ref({
 });
 
 const activeDetailTab = ref('overview');
+const actionInProgress = ref<string | null>(null);
 const closeFullPage = vi.fn();
 const confirmStop = vi.fn();
 const startContainer = vi.fn();
@@ -34,6 +35,7 @@ vi.mock('@/components/containers/containersViewTemplateContext', () => ({
     scanContainer,
     confirmUpdate,
     confirmDelete,
+    actionInProgress,
     registryColorBg: () => '#eee',
     registryColorText: () => '#333',
     registryLabel: () => 'hub',
@@ -57,6 +59,7 @@ function factory() {
 describe('ContainerFullPageDetail', () => {
   afterEach(() => {
     activeDetailTab.value = 'overview';
+    actionInProgress.value = null;
     selectedContainer.value = {
       id: 'container-1',
       name: 'nginx',
@@ -99,4 +102,66 @@ describe('ContainerFullPageDetail', () => {
     await backBtn?.trigger('click');
     expect(closeFullPage).toHaveBeenCalled();
   });
+
+  describe('aria-labels', () => {
+    it('has aria-label on all action buttons', () => {
+      const wrapper = factory();
+      const labels = ['Stop container', 'Restart container', 'Scan container', 'Delete container'];
+      for (const label of labels) {
+        expect(wrapper.find(`button[aria-label="${label}"]`).exists()).toBe(true);
+      }
+    });
+
+    it('has aria-label on Start button when container is stopped', () => {
+      selectedContainer.value.status = 'stopped';
+      const wrapper = factory();
+      expect(wrapper.find('button[aria-label="Start container"]').exists()).toBe(true);
+    });
+
+    it('has aria-label on Update button when update is available', () => {
+      selectedContainer.value.newTag = '2.0';
+      selectedContainer.value.updateKind = 'major';
+      const wrapper = factory();
+      expect(wrapper.find('button[aria-label="Update container"]').exists()).toBe(true);
+    });
+  });
+
+  describe('disabled state during action', () => {
+    it('disables action buttons when actionInProgress matches container name', () => {
+      actionInProgress.value = 'nginx';
+      const wrapper = factory();
+      const actionButtons = wrapper
+        .findAll('button')
+        .filter((b) => b.attributes('aria-label')?.endsWith('container'));
+      for (const btn of actionButtons) {
+        expect(btn.attributes('disabled')).toBeDefined();
+      }
+    });
+
+    it('does not disable buttons when actionInProgress is a different container', () => {
+      actionInProgress.value = 'other-container';
+      const wrapper = factory();
+      const actionButtons = wrapper
+        .findAll('button')
+        .filter((b) => b.attributes('aria-label')?.endsWith('container'));
+      for (const btn of actionButtons) {
+        expect(btn.attributes('disabled')).toBeUndefined();
+      }
+    });
+
+    it('applies opacity-50 class when disabled', () => {
+      actionInProgress.value = 'nginx';
+      const wrapper = factory();
+      const stopBtn = wrapper.find('button[aria-label="Stop container"]');
+      expect(stopBtn.classes()).toContain('opacity-50');
+      expect(stopBtn.classes()).toContain('cursor-not-allowed');
+    });
+
+    it('does not apply opacity-50 class when not disabled', () => {
+      actionInProgress.value = null;
+      const wrapper = factory();
+      const stopBtn = wrapper.find('button[aria-label="Stop container"]');
+      expect(stopBtn.classes()).not.toContain('opacity-50');
+    });
+  });
 });

From 04847fcf3d5a779716925716fa110ee46c6d45a2 Mon Sep 17 00:00:00 2001
From: superuserjr <80784472+turbodaemon@users.noreply.github.com>
Date: Mon, 9 Mar 2026 22:15:01 -0400
Subject: [PATCH 12/34] =?UTF-8?q?=F0=9F=92=84=20style(ui):=20remove=20blue?=
 =?UTF-8?q?=20active=20indicator=20bar=20from=20sidebar=20nav=20items?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 ui/src/layouts/AppLayout.vue | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/ui/src/layouts/AppLayout.vue b/ui/src/layouts/AppLayout.vue
index 3bf4a8a6..5ecb3a25 100644
--- a/ui/src/layouts/AppLayout.vue
+++ b/ui/src/layouts/AppLayout.vue
@@ -1153,9 +1153,6 @@ onUnmounted(() => {
                   : 'dd-text-secondary hover:dd-bg-elevated hover:dd-text',
               ]"
               style="padding: 6px 12px;">
-              <div v-if="route.path === item.route"
-                   class="absolute left-0 top-1/2 -translate-y-1/2 w-[3px] rounded-r-full bg-drydock-secondary"
-                   style="height: 20px;" />
               <AppIcon :name="item.icon" :size="16" class="shrink-0" style="width:20px; text-align:center;" />
               <span class="sidebar-label text-[13px] font-medium">{{ item.label }}</span>
               <span v-if="item.badge && !isCollapsed"

From fd405448c50b8c5b1c97a1318d56f19f66e2b769 Mon Sep 17 00:00:00 2001
From: superuserjr <80784472+turbodaemon@users.noreply.github.com>
Date: Mon, 9 Mar 2026 22:16:16 -0400
Subject: [PATCH 13/34] =?UTF-8?q?=F0=9F=94=A7=20chore:=20add=20compose=20t?=
 =?UTF-8?q?rigger=20to=20QA=20env=20and=20gitignore=20.claude/?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitignore          | 3 ++-
 test/qa-compose.yml | 4 ++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 1d43056a..9d6042a0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -148,6 +148,7 @@ apps/web/content/docs/
 # Storybook build output
 storybook-static/
 
-# Claude Code project instructions
+# Claude Code project instructions and local config
 CLAUDE.md
+.claude/
 artifacts/
diff --git a/test/qa-compose.yml b/test/qa-compose.yml
index 597d2c80..8ef19c7f 100644
--- a/test/qa-compose.yml
+++ b/test/qa-compose.yml
@@ -7,6 +7,7 @@ services:
       - "3333:3000"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
+      - ./qa-compose.yml:/drydock/qa-compose.yml:ro
     environment:
       - DD_RUN_AS_ROOT=true
       - DD_ALLOW_INSECURE_ROOT=true
@@ -38,6 +39,9 @@ services:
       - DD_TRIGGER_SMTP_MYEMAIL_PASS=fakesmtppassword
       - DD_TRIGGER_SMTP_MYEMAIL_FROM=alerts@example.com
       - DD_TRIGGER_SMTP_MYEMAIL_TO=admin@example.com
+      # --- Docker Compose trigger (manual only) ---
+      - DD_TRIGGER_DOCKERCOMPOSE_QA_FILE=/drydock/qa-compose.yml
+      - DD_TRIGGER_DOCKERCOMPOSE_QA_AUTO=false
       # --- GHCR registry (authenticated) ---
       - DD_REGISTRY_GHCR_PRIVATE_USERNAME=myghuser
       - DD_REGISTRY_GHCR_PRIVATE_TOKEN=ghp_fakeGitHubTokenForTesting123

From e2d4970dec57f5f0225652216f537f44fb06a825 Mon Sep 17 00:00:00 2001
From: superuserjr <80784472+turbodaemon@users.noreply.github.com>
Date: Mon, 9 Mar 2026 22:27:15 -0400
Subject: [PATCH 14/34] =?UTF-8?q?=F0=9F=90=9B=20fix(ui):=20clear=20filterK?=
 =?UTF-8?q?ind=20when=20navigating=20via=20Ctrl+K=20search?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

applyFilterSearchFromQuery already cleared dropdown filters (status,
registry, bouncer, server) but missed filterKind. When a user clicked
"Updates Available" on the dashboard (setting filterKind=any) then used
Ctrl+K to search for a container without updates, the persisted
filterKind filter hid the target container.
---
 ui/src/views/ContainersView.vue       | 1 +
 ui/tests/views/ContainersView.spec.ts | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/ui/src/views/ContainersView.vue b/ui/src/views/ContainersView.vue
index a89bb468..c54d0d88 100644
--- a/ui/src/views/ContainersView.vue
+++ b/ui/src/views/ContainersView.vue
@@ -296,6 +296,7 @@ function applyFilterSearchFromQuery(queryValue: unknown) {
     filterRegistry.value = 'all';
     filterBouncer.value = 'all';
     filterServer.value = 'all';
+    filterKind.value = 'all';
   }
 }
 
diff --git a/ui/tests/views/ContainersView.spec.ts b/ui/tests/views/ContainersView.spec.ts
index fe1b81c1..5c8cbf0d 100644
--- a/ui/tests/views/ContainersView.spec.ts
+++ b/ui/tests/views/ContainersView.spec.ts
@@ -424,11 +424,13 @@ describe('ContainersView', () => {
       mockFilterRegistry.value = 'dockerhub';
       mockFilterBouncer.value = 'safe';
       mockFilterServer.value = 'Local';
+      mockFilterKind.value = 'any';
       await mountContainersView([makeContainer()]);
       expect(mockFilterStatus.value).toBe('all');
       expect(mockFilterRegistry.value).toBe('all');
       expect(mockFilterBouncer.value).toBe('all');
       expect(mockFilterServer.value).toBe('all');
+      expect(mockFilterKind.value).toBe('all');
     });
   });
 

From d64e4326277e76fe942e94ffe3ce6f0fe55b25d5 Mon Sep 17 00:00:00 2001
From: superuserjr <80784472+turbodaemon@users.noreply.github.com>
Date: Mon, 9 Mar 2026 22:38:01 -0400
Subject: [PATCH 15/34] =?UTF-8?q?=F0=9F=90=9B=20fix(ui):=20close=20confirm?=
 =?UTF-8?q?=20dialog=20immediately=20on=20accept?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Dialog no longer blocks the UI while the action runs. The
actionInProgress disabled state on buttons provides visual feedback
instead.
---
 ui/src/composables/useConfirmDialog.ts        |  9 +--
 ui/tests/composables/useConfirmDialog.spec.ts | 74 +------------------
 2 files changed, 8 insertions(+), 75 deletions(-)

diff --git a/ui/src/composables/useConfirmDialog.ts b/ui/src/composables/useConfirmDialog.ts
index 16c177de..7b6b7408 100644
--- a/ui/src/composables/useConfirmDialog.ts
+++ b/ui/src/composables/useConfirmDialog.ts
@@ -31,15 +31,14 @@ export function useConfirmDialog() {
       current.value = null;
       return;
     }
-    loading.value = true;
+    // Close dialog immediately — the action buttons show disabled/spinner
+    // state via actionInProgress while the operation runs in the background.
+    visible.value = false;
+    current.value = null;
     try {
       await callback();
     } catch {
       // Callback is responsible for its own error handling.
-    } finally {
-      loading.value = false;
-      visible.value = false;
-      current.value = null;
     }
   }
 
diff --git a/ui/tests/composables/useConfirmDialog.spec.ts b/ui/tests/composables/useConfirmDialog.spec.ts
index cd88a19a..40c85310 100644
--- a/ui/tests/composables/useConfirmDialog.spec.ts
+++ b/ui/tests/composables/useConfirmDialog.spec.ts
@@ -56,7 +56,7 @@ describe('useConfirmDialog', () => {
     expect(dialog.current.value).toBeNull();
   });
 
-  it('accept awaits async callback before closing', async () => {
+  it('closes dialog immediately and runs async callback in background', async () => {
     const useConfirmDialog = await loadComposable();
     const dialog = useConfirmDialog();
     let resolved = false;
@@ -78,82 +78,17 @@ describe('useConfirmDialog', () => {
 
     const acceptPromise = dialog.accept();
 
-    expect(dialog.loading.value).toBe(true);
-    expect(dialog.visible.value).toBe(true);
-
-    await acceptPromise;
-
-    expect(resolved).toBe(true);
-    expect(dialog.loading.value).toBe(false);
+    // Dialog closes immediately — no loading state blocks the UI
     expect(dialog.visible.value).toBe(false);
     expect(dialog.current.value).toBeNull();
-  });
-
-  it('blocks reject and dismiss while loading', async () => {
-    const useConfirmDialog = await loadComposable();
-    const dialog = useConfirmDialog();
-    const onReject = vi.fn();
-    let resolveCallback: () => void;
-    const asyncCallback = () =>
-      new Promise<void>((resolve) => {
-        resolveCallback = resolve;
-      });
-
-    dialog.require({
-      header: 'Stop Container',
-      message: 'Stop nginx?',
-      accept: asyncCallback,
-      reject: onReject,
-    });
-
-    const acceptPromise = dialog.accept();
-    expect(dialog.loading.value).toBe(true);
-
-    dialog.reject();
-    expect(onReject).not.toHaveBeenCalled();
-    expect(dialog.visible.value).toBe(true);
 
-    dialog.dismiss();
-    expect(dialog.visible.value).toBe(true);
-
-    resolveCallback!();
     await acceptPromise;
 
-    expect(dialog.loading.value).toBe(false);
-    expect(dialog.visible.value).toBe(false);
-  });
-
-  it('blocks duplicate accept calls while loading', async () => {
-    const useConfirmDialog = await loadComposable();
-    const dialog = useConfirmDialog();
-    let callCount = 0;
-    let resolveCallback: () => void;
-    const asyncCallback = vi.fn(
-      () =>
-        new Promise<void>((resolve) => {
-          callCount++;
-          resolveCallback = resolve;
-        }),
-    );
-
-    dialog.require({
-      header: 'Restart',
-      message: 'Restart container?',
-      accept: asyncCallback,
-    });
-
-    const firstAccept = dialog.accept();
-    void dialog.accept();
-
+    expect(resolved).toBe(true);
     expect(asyncCallback).toHaveBeenCalledTimes(1);
-
-    resolveCallback!();
-    await firstAccept;
-
-    expect(callCount).toBe(1);
   });
 
-  it('clears loading on callback error', async () => {
+  it('swallows callback errors without leaving stale state', async () => {
     const useConfirmDialog = await loadComposable();
     const dialog = useConfirmDialog();
     const failingCallback = vi.fn(() => Promise.reject(new Error('API failed')));
@@ -166,7 +101,6 @@ describe('useConfirmDialog', () => {
 
     await dialog.accept();
 
-    expect(dialog.loading.value).toBe(false);
     expect(dialog.visible.value).toBe(false);
     expect(dialog.current.value).toBeNull();
   });

From 477e690a83af923e31ee572927037e1c1024a4d6 Mon Sep 17 00:00:00 2001
From: superuserjr <80784472+turbodaemon@users.noreply.github.com>
Date: Mon, 9 Mar 2026 22:45:20 -0400
Subject: [PATCH 16/34] =?UTF-8?q?=E2=99=BB=EF=B8=8F=20refactor(ui):=20remo?=
 =?UTF-8?q?ve=20dead=20loading=20state=20from=20confirm=20dialog?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since the dialog now closes immediately on accept, the loading ref
and all loading-conditional template code are unreachable dead code.
---
 ui/src/components/ConfirmDialog.vue       | 16 ++++----------
 ui/src/composables/useConfirmDialog.ts    | 21 +++---------------
 ui/tests/components/ConfirmDialog.spec.ts | 27 -----------------------
 3 files changed, 7 insertions(+), 57 deletions(-)

diff --git a/ui/src/components/ConfirmDialog.vue b/ui/src/components/ConfirmDialog.vue
index d5aeeca1..2a3d8eb4 100644
--- a/ui/src/components/ConfirmDialog.vue
+++ b/ui/src/components/ConfirmDialog.vue
@@ -1,9 +1,8 @@
 <script setup lang="ts">
 import { onMounted, onUnmounted } from 'vue';
-import AppIcon from './AppIcon.vue';
 import { useConfirmDialog } from '../composables/useConfirmDialog';
 
-const { visible, current, loading, accept, reject, dismiss } = useConfirmDialog();
+const { visible, current, accept, reject, dismiss } = useConfirmDialog();
 const dialogTitleId = 'confirm-dialog-title';
 const dialogDescriptionId = 'confirm-dialog-description';
 
@@ -23,7 +22,7 @@ function isTextEntryTarget(target: EventTarget | null): boolean {
 }
 
 function handleKeydown(e: KeyboardEvent) {
-  if (!visible.value || !current.value || loading.value) {
+  if (!visible.value || !current.value) {
     return;
   }
   if (e.key === 'Escape') {
@@ -77,38 +76,31 @@ onUnmounted(() => globalThis.removeEventListener('keydown', handleKeydown));
           <!-- Footer -->
           <div class="px-5 pt-3 pb-4.5 flex items-center justify-end gap-2.5">
             <button
-              class="px-4 py-1.5 dd-rounded text-[11px] font-semibold transition-colors"
-              :disabled="loading"
+              class="px-4 py-1.5 dd-rounded text-[11px] font-semibold transition-colors cursor-pointer"
               :aria-label="current.rejectLabel || 'Cancel'"
               :style="{
                 backgroundColor: 'var(--dd-bg-inset)',
                 border: '1px solid var(--dd-border-strong)',
                 color: 'var(--dd-text)',
-                opacity: loading ? '0.5' : '1',
-                cursor: loading ? 'not-allowed' : 'pointer',
               }"
               @click="reject">
               {{ current.rejectLabel || 'Cancel' }}
             </button>
             <button
-              class="px-4 py-1.5 dd-rounded text-[11px] font-semibold transition-colors flex items-center gap-1.5"
-              :disabled="loading"
+              class="px-4 py-1.5 dd-rounded text-[11px] font-semibold transition-colors flex items-center gap-1.5 cursor-pointer"
               :aria-label="current.acceptLabel || 'Confirm'"
               :style="current.severity === 'danger'
                 ? {
                     backgroundColor: 'var(--dd-danger-muted)',
                     border: '1px solid var(--dd-danger)',
                     color: 'var(--dd-danger)',
-                    cursor: loading ? 'not-allowed' : 'pointer',
                   }
                 : {
                     backgroundColor: 'var(--dd-warning-muted)',
                     border: '1px solid var(--dd-warning)',
                     color: 'var(--dd-warning)',
-                    cursor: loading ? 'not-allowed' : 'pointer',
                   }"
               @click="accept">
-              <AppIcon v-if="loading" name="restart" :size="11" class="animate-spin" />
               {{ current.acceptLabel || 'Confirm' }}
             </button>
           </div>
diff --git a/ui/src/composables/useConfirmDialog.ts b/ui/src/composables/useConfirmDialog.ts
index 7b6b7408..8dc7fb0d 100644
--- a/ui/src/composables/useConfirmDialog.ts
+++ b/ui/src/composables/useConfirmDialog.ts
@@ -12,29 +12,20 @@ interface ConfirmOptions {
 
 const visible = ref(false);
 const current = ref<ConfirmOptions | null>(null);
-const loading = ref(false);
 
 export function useConfirmDialog() {
   function require(opts: ConfirmOptions) {
     current.value = opts;
     visible.value = true;
-    loading.value = false;
   }
 
   async function accept() {
-    if (loading.value) {
-      return;
-    }
     const callback = current.value?.accept;
+    visible.value = false;
+    current.value = null;
     if (!callback) {
-      visible.value = false;
-      current.value = null;
       return;
     }
-    // Close dialog immediately — the action buttons show disabled/spinner
-    // state via actionInProgress while the operation runs in the background.
-    visible.value = false;
-    current.value = null;
     try {
       await callback();
     } catch {
@@ -43,21 +34,15 @@ export function useConfirmDialog() {
   }
 
   function reject() {
-    if (loading.value) {
-      return;
-    }
     current.value?.reject?.();
     visible.value = false;
     current.value = null;
   }
 
   function dismiss() {
-    if (loading.value) {
-      return;
-    }
     visible.value = false;
     current.value = null;
   }
 
-  return { visible, current, loading, require, accept, reject, dismiss };
+  return { visible, current, require, accept, reject, dismiss };
 }
diff --git a/ui/tests/components/ConfirmDialog.spec.ts b/ui/tests/components/ConfirmDialog.spec.ts
index abdb1934..1bb320eb 100644
--- a/ui/tests/components/ConfirmDialog.spec.ts
+++ b/ui/tests/components/ConfirmDialog.spec.ts
@@ -4,7 +4,6 @@ import ConfirmDialog from '@/components/ConfirmDialog.vue';
 
 const visible = ref(false);
 const current = ref<any>(null);
-const loading = ref(false);
 const accept = vi.fn();
 const reject = vi.fn();
 const dismiss = vi.fn();
@@ -13,7 +12,6 @@ vi.mock('@/composables/useConfirmDialog', () => ({
   useConfirmDialog: () => ({
     visible,
     current,
-    loading,
     accept,
     reject,
     dismiss,
@@ -34,7 +32,6 @@ describe('ConfirmDialog', () => {
   beforeEach(() => {
     visible.value = false;
     current.value = null;
-    loading.value = false;
     accept.mockClear();
     reject.mockClear();
     dismiss.mockClear();
@@ -78,30 +75,6 @@ describe('ConfirmDialog', () => {
     wrapper.unmount();
   });
 
-  it('blocks Escape during loading', async () => {
-    const wrapper = mount(ConfirmDialog);
-    showDialog();
-    loading.value = true;
-    await nextTick();
-
-    globalThis.dispatchEvent(new KeyboardEvent('keydown', { key: 'Escape' }));
-    expect(dismiss).not.toHaveBeenCalled();
-
-    wrapper.unmount();
-  });
-
-  it('blocks Enter during loading', async () => {
-    const wrapper = mount(ConfirmDialog);
-    showDialog();
-    loading.value = true;
-    await nextTick();
-
-    globalThis.dispatchEvent(new KeyboardEvent('keydown', { key: 'Enter' }));
-    expect(accept).not.toHaveBeenCalled();
-
-    wrapper.unmount();
-  });
-
   it('renders dialog semantics when visible', async () => {
     const wrapper = mount(ConfirmDialog);
     showDialog();

From 5f87d7ad7494f2835a92b3f6003e41cc9692e9f7 Mon Sep 17 00:00:00 2001
From: superuserjr <80784472+turbodaemon@users.noreply.github.com>
Date: Mon, 9 Mar 2026 22:46:04 -0400
Subject: [PATCH 17/34] =?UTF-8?q?=F0=9F=93=9D=20docs:=20fix=20stale=20chan?=
 =?UTF-8?q?gelog=20entry=20and=20update=20readme=20compose=20description?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Rewrite confirm dialog changelog entry to reflect final behavior
  (dialog closes immediately, action buttons show spinner/disabled)
- Add missing changelog entry for Ctrl+K filter state fix
- Update README compose feature to say "Docker Engine API" not "docker-compose"
---
 CHANGELOG.md | 3 ++-
 README.md    | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e060cc4a..49002a65 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -122,7 +122,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
-- **Confirm dialog shows loading state during async actions** — Confirm dialog now awaits the async accept callback before closing, showing a spinner on the accept button and disabling all dismiss interactions (buttons, Escape, Enter, backdrop click) while the action runs. Previously, the dialog closed immediately on confirm, causing the UI to appear unresponsive until the action completed in the background.
+- **Action buttons disable and show spinner during in-progress actions** — Container action buttons (Stop, Start, Restart, Update, Delete) now show a disabled state with a spinner while the action runs in the background, providing clear visual feedback. The confirm dialog closes immediately on accept instead of blocking the UI.
+- **Command palette clears stale filter on navigation** — Navigating to a container via Ctrl+K search now clears the active `filterKind`, preventing stale filter state from hiding the navigated container.
 - **Manual update button works with compose triggers** — The update container endpoint now searches for both `docker` and `dockercompose` trigger types, matching the existing preview endpoint behavior. Previously, users with only a compose trigger saw "No docker trigger found for this container".
 - **CI: qlty retry on timeout** — Changed `retry_on` from `error` to `any` so qlty timeouts trigger retries. Increased timeout from 5 to 8 minutes.
 - **OIDC docs clarified `DD_PUBLIC_URL` requirement** — OIDC documentation now explicitly marks `DD_PUBLIC_URL` as required and includes it in all provider example configurations (Authelia, Auth0, Authentik, Dex). Without this variable, the OIDC provider fails to register at startup.
diff --git a/README.md b/README.md
index a11e71c7..be47edfa 100644
--- a/README.md
+++ b/README.md
@@ -204,7 +204,7 @@ Docker Hub, GHCR, ECR, GCR, GAR, GitLab, Quay, Harbor, Artifactory, Nexus, and m
 <tr>
 <td align="center">
 <h3>Docker Compose Updates</h3>
-Auto-pull and recreate services via docker-compose with service-scoped compose image patching
+Auto-pull and recreate services via Docker Engine API with YAML-preserving service-scoped image patching
 </td>
 <td align="center">
 <h3>Distributed Agents</h3>

From abb4581a421ce5687676e004ca02220f2bb0d3de Mon Sep 17 00:00:00 2001
From: superuserjr <80784472+turbodaemon@users.noreply.github.com>
Date: Mon, 9 Mar 2026 22:51:57 -0400
Subject: [PATCH 18/34] =?UTF-8?q?=F0=9F=97=91=EF=B8=8F=20refactor(ui):=20r?=
 =?UTF-8?q?emove=2010=20dead=20icon/color=20functions=20and=20their=20test?=
 =?UTF-8?q?s?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Remove getContainerIcon, getServerIcon, getLogIcon, getRegistryIcon,
getTriggerIcon, getWatcherIcon, getAgentIcon, getAuditIcon,
getAuthenticationIcon, and bouncerColor — all exported but never
imported anywhere in the codebase.
---
 ui/src/services/agent.ts                 |  4 ----
 ui/src/services/audit.ts                 |  4 ----
 ui/src/services/authentication.ts        | 12 +-----------
 ui/src/services/container.ts             |  5 -----
 ui/src/services/log.ts                   |  6 +-----
 ui/src/services/registry.ts              | 16 +---------------
 ui/src/services/server.ts                |  6 +-----
 ui/src/services/trigger.ts               | 13 +------------
 ui/src/services/watcher.ts               | 12 +-----------
 ui/src/utils/display.ts                  |  6 ------
 ui/tests/services/agent.spec.ts          |  8 +-------
 ui/tests/services/app.spec.ts            |  6 +-----
 ui/tests/services/audit.spec.ts          |  6 +-----
 ui/tests/services/authentication.spec.ts |  5 -----
 ui/tests/services/container.spec.ts      |  7 -------
 ui/tests/services/log.spec.ts            |  6 +-----
 ui/tests/services/registry.spec.ts       |  7 -------
 ui/tests/services/server.spec.ts         |  6 +-----
 ui/tests/services/trigger.spec.ts        |  7 -------
 ui/tests/services/watcher.spec.ts        |  5 -----
 ui/tests/utils/display.spec.ts           | 24 ------------------------
 21 files changed, 11 insertions(+), 160 deletions(-)

diff --git a/ui/src/services/agent.ts b/ui/src/services/agent.ts
index 051248ba..4faf4fa7 100644
--- a/ui/src/services/agent.ts
+++ b/ui/src/services/agent.ts
@@ -2,10 +2,6 @@ import { extractCollectionData } from '../utils/api';
 
 const BASE_URL = '/api/agents';
 
-export function getAgentIcon() {
-  return 'sh-robot';
-}
-
 export async function getAgents() {
   const response = await fetch(BASE_URL, { credentials: 'include' });
   if (!response.ok) {
diff --git a/ui/src/services/audit.ts b/ui/src/services/audit.ts
index 6e96058e..6302c148 100644
--- a/ui/src/services/audit.ts
+++ b/ui/src/services/audit.ts
@@ -40,7 +40,3 @@ export async function getAuditLog(
   }
   return payload;
 }
-
-export function getAuditIcon() {
-  return 'sh-clock-rotate-left';
-}
diff --git a/ui/src/services/authentication.ts b/ui/src/services/authentication.ts
index a6eaefaf..27adb424 100644
--- a/ui/src/services/authentication.ts
+++ b/ui/src/services/authentication.ts
@@ -1,9 +1,5 @@
 import { extractCollectionData } from '../utils/api';
 
-function getAuthenticationIcon() {
-  return 'sh-lock';
-}
-
 interface AuthenticationDetailPathOptions {
   type: string;
   name: string;
@@ -64,10 +60,4 @@ async function getAuthentication({ type, name, agent }: AuthenticationDetailPath
   return response.json();
 }
 
-export {
-  getAuthenticationIcon,
-  getAuthProviderIcon,
-  getAuthProviderColor,
-  getAllAuthentications,
-  getAuthentication,
-};
+export { getAuthProviderIcon, getAuthProviderColor, getAllAuthentications, getAuthentication };
diff --git a/ui/src/services/container.ts b/ui/src/services/container.ts
index a614421e..4a7d4bdc 100644
--- a/ui/src/services/container.ts
+++ b/ui/src/services/container.ts
@@ -1,10 +1,6 @@
 import { extractCollectionData } from '../utils/api';
 import { ApiError, errorMessage } from '../utils/error';
 
-function getContainerIcon() {
-  return 'sh-docker';
-}
-
 interface ContainerGroupMember {
   id: string;
   name: string;
@@ -358,7 +354,6 @@ async function revealContainerEnv(containerId: string) {
 }
 
 export {
-  getContainerIcon,
   getAllContainers,
   getContainerRecentStatus,
   getContainerSummary,
diff --git a/ui/src/services/log.ts b/ui/src/services/log.ts
index 367b5a51..a311e1b9 100644
--- a/ui/src/services/log.ts
+++ b/ui/src/services/log.ts
@@ -1,7 +1,3 @@
-function getLogIcon() {
-  return 'sh-scroll';
-}
-
 async function getLog() {
   const response = await fetch('/api/log', { credentials: 'include' });
   if (!response.ok) {
@@ -29,4 +25,4 @@ async function getLogEntries(
   return response.json();
 }
 
-export { getLogIcon, getLog, getLogEntries };
+export { getLog, getLogEntries };
diff --git a/ui/src/services/registry.ts b/ui/src/services/registry.ts
index 4e9b31c3..f8245f93 100644
--- a/ui/src/services/registry.ts
+++ b/ui/src/services/registry.ts
@@ -1,13 +1,5 @@
 import { extractCollectionData } from '../utils/api';
 
-/**
- * Get registry component icon.
- * @returns {string}
- */
-function getRegistryIcon() {
-  return 'sh-docker';
-}
-
 /**
  * Get registry provider icon (acr, ecr...).
  * @param provider
@@ -114,10 +106,4 @@ async function getRegistry({ type, name, agent }: RegistryDetailPathOptions) {
   return response.json();
 }
 
-export {
-  getRegistryIcon,
-  getRegistryProviderIcon,
-  getRegistryProviderColor,
-  getAllRegistries,
-  getRegistry,
-};
+export { getRegistryProviderIcon, getRegistryProviderColor, getAllRegistries, getRegistry };
diff --git a/ui/src/services/server.ts b/ui/src/services/server.ts
index 555ba035..85c48d54 100644
--- a/ui/src/services/server.ts
+++ b/ui/src/services/server.ts
@@ -1,7 +1,3 @@
-function getServerIcon() {
-  return 'sh-server';
-}
-
 async function getServer() {
   const response = await fetch('/api/server', { credentials: 'include' });
   if (!response.ok) {
@@ -25,4 +21,4 @@ async function getSecurityRuntime() {
   return response.json();
 }
 
-export { getServerIcon, getServer, getSecurityRuntime };
+export { getServer, getSecurityRuntime };
diff --git a/ui/src/services/trigger.ts b/ui/src/services/trigger.ts
index 27f5c22f..e8f49285 100644
--- a/ui/src/services/trigger.ts
+++ b/ui/src/services/trigger.ts
@@ -1,9 +1,5 @@
 import { extractCollectionData } from '../utils/api';
 
-function getTriggerIcon() {
-  return 'sh-bolt';
-}
-
 interface TriggerDetailPathOptions {
   type: string;
   name: string;
@@ -160,11 +156,4 @@ async function runTrigger({
   return json;
 }
 
-export {
-  getTriggerIcon,
-  getTriggerProviderIcon,
-  getTriggerProviderColor,
-  getAllTriggers,
-  getTrigger,
-  runTrigger,
-};
+export { getTriggerProviderIcon, getTriggerProviderColor, getAllTriggers, getTrigger, runTrigger };
diff --git a/ui/src/services/watcher.ts b/ui/src/services/watcher.ts
index 39f21e58..dd44578f 100644
--- a/ui/src/services/watcher.ts
+++ b/ui/src/services/watcher.ts
@@ -1,9 +1,5 @@
 import { extractCollectionData } from '../utils/api';
 
-function getWatcherIcon() {
-  return 'sh-eye';
-}
-
 interface WatcherDetailPathOptions {
   type: string;
   name: string;
@@ -52,10 +48,4 @@ async function getWatcher({ type, name, agent }: WatcherDetailPathOptions) {
   return response.json();
 }
 
-export {
-  getWatcherIcon,
-  getWatcherProviderIcon,
-  getWatcherProviderColor,
-  getAllWatchers,
-  getWatcher,
-};
+export { getWatcherProviderIcon, getWatcherProviderColor, getAllWatchers, getWatcher };
diff --git a/ui/src/utils/display.ts b/ui/src/utils/display.ts
index 57f86bb0..6502e089 100644
--- a/ui/src/utils/display.ts
+++ b/ui/src/utils/display.ts
@@ -63,9 +63,3 @@ export function updateKindColor(kind: string | null) {
   if (kind === 'digest') return { bg: 'var(--dd-neutral-muted)', text: 'var(--dd-neutral)' };
   return { bg: 'transparent', text: 'transparent' };
 }
-
-export function bouncerColor(status: string) {
-  if (status === 'safe') return { bg: 'var(--dd-success-muted)', text: 'var(--dd-success)' };
-  if (status === 'unsafe') return { bg: 'var(--dd-warning-muted)', text: 'var(--dd-warning)' };
-  return { bg: 'var(--dd-danger-muted)', text: 'var(--dd-danger)' };
-}
diff --git a/ui/tests/services/agent.spec.ts b/ui/tests/services/agent.spec.ts
index 03559d94..6de477bb 100644
--- a/ui/tests/services/agent.spec.ts
+++ b/ui/tests/services/agent.spec.ts
@@ -1,4 +1,4 @@
-import { getAgentIcon, getAgents } from '@/services/agent';
+import { getAgents } from '@/services/agent';
 
 global.fetch = vi.fn();
 
@@ -7,12 +7,6 @@ describe('Agent Service', () => {
     vi.mocked(fetch).mockClear();
   });
 
-  describe('getAgentIcon', () => {
-    it('returns the agent icon', () => {
-      expect(getAgentIcon()).toBe('sh-robot');
-    });
-  });
-
   describe('getAgents', () => {
     it('fetches agents successfully', async () => {
       const mockAgents = [
diff --git a/ui/tests/services/app.spec.ts b/ui/tests/services/app.spec.ts
index efd0a5d6..f7395221 100644
--- a/ui/tests/services/app.spec.ts
+++ b/ui/tests/services/app.spec.ts
@@ -1,5 +1,5 @@
 import { getAppInfos } from '@/services/app';
-import { getServer, getServerIcon } from '@/services/server';
+import { getServer } from '@/services/server';
 
 describe('App Service', () => {
   beforeEach(() => {
@@ -39,10 +39,6 @@ describe('Server Service', () => {
     global.fetch = vi.fn();
   });
 
-  it('should return server icon', () => {
-    expect(getServerIcon()).toBe('sh-server');
-  });
-
   it('should get server data', async () => {
     const mockResponse = { configuration: {} };
     global.fetch.mockResolvedValue({
diff --git a/ui/tests/services/audit.spec.ts b/ui/tests/services/audit.spec.ts
index f9721eb7..48ebc97d 100644
--- a/ui/tests/services/audit.spec.ts
+++ b/ui/tests/services/audit.spec.ts
@@ -1,4 +1,4 @@
-import { getAuditIcon, getAuditLog } from '@/services/audit';
+import { getAuditLog } from '@/services/audit';
 
 describe('audit service', () => {
   beforeEach(() => {
@@ -140,8 +140,4 @@ describe('audit service', () => {
 
     await expect(getAuditLog()).rejects.toThrow('Failed to fetch audit log: Internal Server Error');
   });
-
-  it('getAuditIcon returns the correct icon', () => {
-    expect(getAuditIcon()).toBe('sh-clock-rotate-left');
-  });
 });
diff --git a/ui/tests/services/authentication.spec.ts b/ui/tests/services/authentication.spec.ts
index c22f4d5c..b78a380e 100644
--- a/ui/tests/services/authentication.spec.ts
+++ b/ui/tests/services/authentication.spec.ts
@@ -1,7 +1,6 @@
 import {
   getAllAuthentications,
   getAuthentication,
-  getAuthenticationIcon,
   getAuthProviderColor,
   getAuthProviderIcon,
 } from '@/services/authentication';
@@ -13,10 +12,6 @@ describe('Authentication Service', () => {
     vi.mocked(fetch).mockClear();
   });
 
-  it('returns the default authentication icon', () => {
-    expect(getAuthenticationIcon()).toBe('sh-lock');
-  });
-
   it('returns provider icon for known authentication types', () => {
     expect(getAuthProviderIcon('basic')).toBe('sh-key');
     expect(getAuthProviderIcon('oidc')).toBe('sh-openid');
diff --git a/ui/tests/services/container.spec.ts b/ui/tests/services/container.spec.ts
index be2dd09a..8b569fae 100644
--- a/ui/tests/services/container.spec.ts
+++ b/ui/tests/services/container.spec.ts
@@ -1,7 +1,6 @@
 import {
   deleteContainer,
   getAllContainers,
-  getContainerIcon,
   getContainerLogs,
   getContainerRecentStatus,
   getContainerSbom,
@@ -27,12 +26,6 @@ describe('Container Service', () => {
     vi.mocked(fetch).mockClear();
   });
 
-  describe('getContainerIcon', () => {
-    it('returns the docker icon', () => {
-      expect(getContainerIcon()).toBe('sh-docker');
-    });
-  });
-
   describe('getAllContainers', () => {
     it('fetches all containers successfully', async () => {
       const mockContainers = [
diff --git a/ui/tests/services/log.spec.ts b/ui/tests/services/log.spec.ts
index 920a6f12..82a2fb36 100644
--- a/ui/tests/services/log.spec.ts
+++ b/ui/tests/services/log.spec.ts
@@ -1,14 +1,10 @@
-import { getLog, getLogEntries, getLogIcon } from '@/services/log';
+import { getLog, getLogEntries } from '@/services/log';
 
 describe('Log Service', () => {
   beforeEach(() => {
     global.fetch = vi.fn();
   });
 
-  it('should return log icon', () => {
-    expect(getLogIcon()).toBe('sh-scroll');
-  });
-
   it('should get log', async () => {
     const mockResponse = { logs: [] };
     global.fetch.mockResolvedValue({
diff --git a/ui/tests/services/registry.spec.ts b/ui/tests/services/registry.spec.ts
index f8c858d7..aabe0b82 100644
--- a/ui/tests/services/registry.spec.ts
+++ b/ui/tests/services/registry.spec.ts
@@ -1,7 +1,6 @@
 import {
   getAllRegistries,
   getRegistry,
-  getRegistryIcon,
   getRegistryProviderColor,
   getRegistryProviderIcon,
 } from '@/services/registry';
@@ -14,12 +13,6 @@ describe('Registry Service', () => {
     vi.mocked(fetch).mockClear();
   });
 
-  describe('getRegistryIcon', () => {
-    it('returns the registry icon', () => {
-      expect(getRegistryIcon()).toBe('sh-docker');
-    });
-  });
-
   describe('getRegistryProviderIcon', () => {
     it('returns correct icons for different providers', () => {
       expect(getRegistryProviderIcon('acr.example.com')).toBe('sh-microsoft');
diff --git a/ui/tests/services/server.spec.ts b/ui/tests/services/server.spec.ts
index 8d551d53..f1739980 100644
--- a/ui/tests/services/server.spec.ts
+++ b/ui/tests/services/server.spec.ts
@@ -1,4 +1,4 @@
-import { getSecurityRuntime, getServer, getServerIcon } from '@/services/server';
+import { getSecurityRuntime, getServer } from '@/services/server';
 
 global.fetch = vi.fn();
 
@@ -7,10 +7,6 @@ describe('Server Service', () => {
     vi.mocked(fetch).mockClear();
   });
 
-  it('returns server icon', () => {
-    expect(getServerIcon()).toBe('sh-server');
-  });
-
   it('fetches server configuration', async () => {
     const payload = { configuration: { port: 3000 } };
     vi.mocked(fetch).mockResolvedValueOnce({
diff --git a/ui/tests/services/trigger.spec.ts b/ui/tests/services/trigger.spec.ts
index e5c4f4cf..fa63f3cb 100644
--- a/ui/tests/services/trigger.spec.ts
+++ b/ui/tests/services/trigger.spec.ts
@@ -1,7 +1,6 @@
 import {
   getAllTriggers,
   getTrigger,
-  getTriggerIcon,
   getTriggerProviderColor,
   getTriggerProviderIcon,
   runTrigger,
@@ -14,12 +13,6 @@ describe('Trigger Service', () => {
     vi.mocked(fetch).mockClear();
   });
 
-  describe('getTriggerIcon', () => {
-    it('returns the trigger icon', () => {
-      expect(getTriggerIcon()).toBe('sh-bolt');
-    });
-  });
-
   describe('getTriggerProviderIcon', () => {
     it.each([
       ['http', 'sh-globe'],
diff --git a/ui/tests/services/watcher.spec.ts b/ui/tests/services/watcher.spec.ts
index c1a535f0..f0231346 100644
--- a/ui/tests/services/watcher.spec.ts
+++ b/ui/tests/services/watcher.spec.ts
@@ -1,7 +1,6 @@
 import {
   getAllWatchers,
   getWatcher,
-  getWatcherIcon,
   getWatcherProviderColor,
   getWatcherProviderIcon,
 } from '@/services/watcher';
@@ -11,10 +10,6 @@ describe('Watcher Service', () => {
     global.fetch = vi.fn();
   });
 
-  it('should return watcher icon', () => {
-    expect(getWatcherIcon()).toBe('sh-eye');
-  });
-
   it('returns docker icon for docker provider', () => {
     expect(getWatcherProviderIcon('docker')).toBe('sh-docker');
   });
diff --git a/ui/tests/utils/display.spec.ts b/ui/tests/utils/display.spec.ts
index 5117f4a2..f424bbfc 100644
--- a/ui/tests/utils/display.spec.ts
+++ b/ui/tests/utils/display.spec.ts
@@ -1,5 +1,4 @@
 import {
-  bouncerColor,
   parseServer,
   registryColorBg,
   registryColorText,
@@ -153,27 +152,4 @@ describe('display utilities', () => {
       expect(updateKindColor(null)).toEqual({ bg: 'transparent', text: 'transparent' });
     });
   });
-
-  describe('bouncerColor', () => {
-    it('returns success for safe', () => {
-      expect(bouncerColor('safe')).toEqual({
-        bg: 'var(--dd-success-muted)',
-        text: 'var(--dd-success)',
-      });
-    });
-
-    it('returns warning for unsafe', () => {
-      expect(bouncerColor('unsafe')).toEqual({
-        bg: 'var(--dd-warning-muted)',
-        text: 'var(--dd-warning)',
-      });
-    });
-
-    it('returns danger for blocked', () => {
-      expect(bouncerColor('blocked')).toEqual({
-        bg: 'var(--dd-danger-muted)',
-        text: 'var(--dd-danger)',
-      });
-    });
-  });
 });

From 2532395da55b25b7d21bb9f026c27d6c6587ec15 Mon Sep 17 00:00:00 2001
From: superuserjr <80784472+turbodaemon@users.noreply.github.com>
Date: Mon, 9 Mar 2026 22:52:09 -0400
Subject: [PATCH 19/34] =?UTF-8?q?=F0=9F=97=91=EF=B8=8F=20chore:=20remove?=
 =?UTF-8?q?=20dead=20config=20(babel.config.js,=20doc=20script,=20!website?=
 =?UTF-8?q?)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Delete ui/babel.config.js — Babel is not a dependency (Vite handles builds)
- Remove "doc" script from app/package.json — references non-existent .docsify
- Remove "!website" from biome.json includes — no website/ directory exists
---
 app/package.json   | 1 -
 biome.json         | 2 +-
 ui/babel.config.js | 8 --------
 3 files changed, 1 insertion(+), 10 deletions(-)
 delete mode 100644 ui/babel.config.js

diff --git a/app/package.json b/app/package.json
index f2b2a407..252d06aa 100644
--- a/app/package.json
+++ b/app/package.json
@@ -10,7 +10,6 @@
   "scripts": {
     "build": "tsc && node scripts/copy-static-assets.mjs",
     "start": "nodemon --exec \"ts-node --esm\" index.ts",
-    "doc": ".docsify serve ./docs",
     "format": "biome format --write .",
     "lint:fix": "biome check --fix .",
     "lint": "biome check .",
diff --git a/biome.json b/biome.json
index df30fa21..02fdbae8 100644
--- a/biome.json
+++ b/biome.json
@@ -7,7 +7,7 @@
   },
   "files": {
     "ignoreUnknown": true,
-    "includes": ["**", "!ui/public/index.html", "!website", "!apps/web/app/globals.css"]
+    "includes": ["**", "!ui/public/index.html", "!apps/web/app/globals.css"]
   },
   "formatter": {
     "enabled": true,
diff --git a/ui/babel.config.js b/ui/babel.config.js
deleted file mode 100644
index eeca9b42..00000000
--- a/ui/babel.config.js
+++ /dev/null
@@ -1,8 +0,0 @@
-module.exports = {
-  presets: ['@babel/preset-env'],
-  env: {
-    test: {
-      presets: [['@babel/preset-env', { targets: { node: 'current' } }]],
-    },
-  },
-};

From d75389b4593d86e3140ca7486ed17f588901d09e Mon Sep 17 00:00:00 2001
From: superuserjr <80784472+turbodaemon@users.noreply.github.com>
Date: Mon, 9 Mar 2026 22:56:32 -0400
Subject: [PATCH 20/34] =?UTF-8?q?=F0=9F=97=91=EF=B8=8F=20refactor(app):=20?=
 =?UTF-8?q?remove=20dead=20buildComposeCommandEnvironment?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The compose trigger was refactored to use the Docker Engine API directly.
The CLI environment sanitizer and its allowlists are no longer needed.
---
 app/runtime/child-process-env.test.ts | 64 +--------------------------
 app/runtime/child-process-env.ts      | 28 ------------
 2 files changed, 2 insertions(+), 90 deletions(-)

diff --git a/app/runtime/child-process-env.test.ts b/app/runtime/child-process-env.test.ts
index 9171a001..f484af60 100644
--- a/app/runtime/child-process-env.test.ts
+++ b/app/runtime/child-process-env.test.ts
@@ -1,12 +1,8 @@
-import {
-  buildComposeCommandEnvironment,
-  buildHookCommandEnvironment,
-} from './child-process-env.js';
+import { buildHookCommandEnvironment } from './child-process-env.js';
 
 describe('runtime/child-process-env', () => {
-  test('returns empty env objects when parent env is empty', () => {
+  test('returns empty env object when parent env is empty', () => {
     expect(buildHookCommandEnvironment({}, {})).toEqual({});
-    expect(buildComposeCommandEnvironment({})).toEqual({});
   });
 
   test('buildHookCommandEnvironment keeps only base allowlisted vars and applies overrides', () => {
@@ -42,60 +38,4 @@ describe('runtime/child-process-env', () => {
       SECRET_TOKEN: 'override-only',
     });
   });
-
-  test('buildComposeCommandEnvironment keeps compose and docker env vars only', () => {
-    const parentEnv = {
-      PATH: '/usr/bin',
-      DOCKER_HOST: 'unix:///var/run/docker.sock',
-      COMPOSE_FILE: 'compose.yaml',
-      COMPOSE_PROJECT_NAME: 'drydock',
-      CUSTOM_VAR: 'nope',
-      HTTP_PROXY: 'http://proxy',
-      NO_PROXY: undefined,
-    };
-
-    expect(buildComposeCommandEnvironment(parentEnv)).toEqual({
-      PATH: '/usr/bin',
-      DOCKER_HOST: 'unix:///var/run/docker.sock',
-      COMPOSE_FILE: 'compose.yaml',
-      COMPOSE_PROJECT_NAME: 'drydock',
-      HTTP_PROXY: 'http://proxy',
-    });
-  });
-
-  test('buildComposeCommandEnvironment matches COMPOSE_ prefix strictly at the start', () => {
-    const parentEnv = {
-      COMPOSE_FILE: 'compose.yaml',
-      COMPOSE_: 'edge',
-      COMPOSE__EXTRA: 'double-underscore',
-      XCOMPOSE_FILE: 'nope',
-      compose_FILE: 'nope',
-      COMPOSE: 'nope',
-    };
-
-    expect(buildComposeCommandEnvironment(parentEnv)).toEqual({
-      COMPOSE_FILE: 'compose.yaml',
-      COMPOSE_: 'edge',
-      COMPOSE__EXTRA: 'double-underscore',
-    });
-  });
-
-  test('buildComposeCommandEnvironment handles large parent env input', () => {
-    const largeParentEnv: Record<string, string> = {
-      PATH: '/usr/bin',
-      DOCKER_HOST: 'unix:///var/run/docker.sock',
-      COMPOSE_PROJECT_NAME: 'drydock',
-      SECRET_TOKEN: 'should-not-leak',
-    };
-
-    for (let index = 0; index < 5_000; index += 1) {
-      largeParentEnv[`UNRELATED_${index}`] = `value-${index}`;
-    }
-
-    expect(buildComposeCommandEnvironment(largeParentEnv)).toEqual({
-      PATH: '/usr/bin',
-      DOCKER_HOST: 'unix:///var/run/docker.sock',
-      COMPOSE_PROJECT_NAME: 'drydock',
-    });
-  });
 });
diff --git a/app/runtime/child-process-env.ts b/app/runtime/child-process-env.ts
index 13fef377..d67636db 100644
--- a/app/runtime/child-process-env.ts
+++ b/app/runtime/child-process-env.ts
@@ -17,24 +17,6 @@ const BASE_ALLOWLISTED_ENV_KEYS = new Set([
   'USER',
 ]);
 
-const COMPOSE_ALLOWLISTED_ENV_KEYS = new Set([
-  ...BASE_ALLOWLISTED_ENV_KEYS,
-  'DOCKER_BUILDKIT',
-  'DOCKER_CERT_PATH',
-  'DOCKER_CONFIG',
-  'DOCKER_CONTEXT',
-  'DOCKER_HOST',
-  'DOCKER_TLS_VERIFY',
-  'HTTPS_PROXY',
-  'HTTP_PROXY',
-  'NO_PROXY',
-  'https_proxy',
-  'http_proxy',
-  'no_proxy',
-]);
-
-const COMPOSE_ALLOWLISTED_ENV_PREFIXES = ['COMPOSE_'];
-
 type ChildProcessEnv = Record<string, string>;
 
 function buildAllowlistedEnvironment(
@@ -67,13 +49,3 @@ export function buildHookCommandEnvironment(
     ...overrides,
   };
 }
-
-export function buildComposeCommandEnvironment(
-  parentEnv: NodeJS.ProcessEnv = process.env,
-): ChildProcessEnv {
-  return buildAllowlistedEnvironment(
-    parentEnv,
-    COMPOSE_ALLOWLISTED_ENV_KEYS,
-    COMPOSE_ALLOWLISTED_ENV_PREFIXES,
-  );
-}

From 68c6c0137d7888c5f7d3667998da0b882cd842c8 Mon Sep 17 00:00:00 2001
From: superuserjr <80784472+turbodaemon@users.noreply.github.com>
Date: Mon, 9 Mar 2026 22:56:39 -0400
Subject: [PATCH 21/34] =?UTF-8?q?=F0=9F=97=91=EF=B8=8F=20refactor(ui):=20r?=
 =?UTF-8?q?emove=20unused=20type=20exports=20from=20container=20service?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

AggregatedSecurityImage, AggregatedSecuritySummary,
AggregatedSecurityVulnerability, and SecurityVulnerabilityOverview
are used internally but never imported by other files.
---
 ui/src/services/container.ts | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/ui/src/services/container.ts b/ui/src/services/container.ts
index 4a7d4bdc..21a0d6bf 100644
--- a/ui/src/services/container.ts
+++ b/ui/src/services/container.ts
@@ -374,9 +374,3 @@ export {
 };
 
 export type { ContainerGroup };
-export type {
-  AggregatedSecurityImage,
-  AggregatedSecuritySummary,
-  AggregatedSecurityVulnerability,
-  SecurityVulnerabilityOverview,
-};

From e6b390590440ee44855855fe03cbad82688a87fe Mon Sep 17 00:00:00 2001
From: superuserjr <80784472+turbodaemon@users.noreply.github.com>
Date: Tue, 10 Mar 2026 08:28:08 -0400
Subject: [PATCH 22/34] =?UTF-8?q?=F0=9F=90=9B=20fix(ui):=20accept=20colon-?=
 =?UTF-8?q?separated=20icon=20prefixes=20in=20dd.display.icon=20label?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Normalize sh:, hl:, and si: colon prefixes to dash format (sh-, hl-,
si-) so both separator styles work in Docker labels. Users naturally
use colon notation since it's the common convention in icon systems
like Iconify.

Fixes: #127
---
 ui/src/components/ContainerIcon.vue       |  9 +++++++--
 ui/src/services/image-icon.ts             | 10 +++++++++-
 ui/tests/components/ContainerIcon.spec.ts | 21 +++++++++++++++++++++
 ui/tests/services/image-icon.spec.ts      |  8 ++++++++
 4 files changed, 45 insertions(+), 3 deletions(-)

diff --git a/ui/src/components/ContainerIcon.vue b/ui/src/components/ContainerIcon.vue
index 71d35d01..a0fe7585 100644
--- a/ui/src/components/ContainerIcon.vue
+++ b/ui/src/components/ContainerIcon.vue
@@ -23,8 +23,13 @@ const failed = ref(false);
  *   other       → treat as selfhst slug
  */
 const resolved = computed(() => {
-  const icon = props.icon;
-  if (!icon) return { type: 'fallback' as const };
+  // Normalize colon-separated prefixes (sh:slug → sh-slug)
+  const raw = props.icon;
+  if (!raw) return { type: 'fallback' as const };
+  const icon =
+    raw.startsWith('sh:') || raw.startsWith('hl:') || raw.startsWith('si:')
+      ? `${raw.slice(0, 2)}-${raw.slice(3)}`
+      : raw;
 
   if (icon.startsWith('sh-')) {
     return { type: 'proxy' as const, src: `/api/icons/selfhst/${icon.slice(3)}` };
diff --git a/ui/src/services/image-icon.ts b/ui/src/services/image-icon.ts
index 54325c58..e9445878 100644
--- a/ui/src/services/image-icon.ts
+++ b/ui/src/services/image-icon.ts
@@ -18,6 +18,14 @@ function isLegacyOrDefaultIcon(displayIcon: string): boolean {
   return displayIcon.startsWith('mdi:') || displayIcon.startsWith('mdi-');
 }
 
+/** Normalize colon-separated icon prefixes (sh:slug) to dash format (sh-slug). */
+function normalizeIconPrefix(icon: string): string {
+  if (icon.startsWith('sh:')) return `sh-${icon.slice(3)}`;
+  if (icon.startsWith('hl:')) return `hl-${icon.slice(3)}`;
+  if (icon.startsWith('si:')) return `si-${icon.slice(3)}`;
+  return icon;
+}
+
 /**
  * Curated map: Docker image base name -> Dashboard Icons slug.
  * Only needed when the image name differs from the icon slug.
@@ -283,7 +291,7 @@ function resolveIconSlug(imageName: string): string | null {
 export function getEffectiveDisplayIcon(displayIcon: string, imageName: string): string {
   // User set a modern icon (hl-, sh-, si-, fa*, or URL) — respect it
   if (!isLegacyOrDefaultIcon(displayIcon)) {
-    return displayIcon;
+    return normalizeIconPrefix(displayIcon);
   }
 
   // Auto-resolve from image name
diff --git a/ui/tests/components/ContainerIcon.spec.ts b/ui/tests/components/ContainerIcon.spec.ts
index f7ff5076..530a27fa 100644
--- a/ui/tests/components/ContainerIcon.spec.ts
+++ b/ui/tests/components/ContainerIcon.spec.ts
@@ -34,6 +34,27 @@ describe('ContainerIcon', () => {
     expect(img.attributes('src')).toBe('/api/icons/simple/docker');
   });
 
+  it('normalizes colon-separated sh: prefix to dash', () => {
+    const wrapper = factory({ icon: 'sh:z-wave-js-ui' });
+    const img = wrapper.find('img');
+    expect(img.exists()).toBe(true);
+    expect(img.attributes('src')).toBe('/api/icons/selfhst/z-wave-js-ui');
+  });
+
+  it('normalizes colon-separated hl: prefix to dash', () => {
+    const wrapper = factory({ icon: 'hl:portainer' });
+    const img = wrapper.find('img');
+    expect(img.exists()).toBe(true);
+    expect(img.attributes('src')).toBe('/api/icons/homarr/portainer');
+  });
+
+  it('normalizes colon-separated si: prefix to dash', () => {
+    const wrapper = factory({ icon: 'si:docker' });
+    const img = wrapper.find('img');
+    expect(img.exists()).toBe(true);
+    expect(img.attributes('src')).toBe('/api/icons/simple/docker');
+  });
+
   it('renders direct URL for http:// prefix', () => {
     const wrapper = factory({ icon: 'http://example.com/icon.png' });
     const img = wrapper.find('img');
diff --git a/ui/tests/services/image-icon.spec.ts b/ui/tests/services/image-icon.spec.ts
index 1bdaad16..18eb9ee3 100644
--- a/ui/tests/services/image-icon.spec.ts
+++ b/ui/tests/services/image-icon.spec.ts
@@ -6,6 +6,14 @@ describe('image-icon service', () => {
     expect(getEffectiveDisplayIcon('hl-custom', 'library/nginx:latest')).toBe('hl-custom');
   });
 
+  it('normalizes colon-separated icon prefixes to dash format', () => {
+    expect(getEffectiveDisplayIcon('sh:z-wave-js-ui', 'zwavejs/zwave-js-ui')).toBe(
+      'sh-z-wave-js-ui',
+    );
+    expect(getEffectiveDisplayIcon('hl:nginx', 'library/nginx')).toBe('hl-nginx');
+    expect(getEffectiveDisplayIcon('si:docker', 'library/nginx')).toBe('si-docker');
+  });
+
   it('auto-resolves legacy mdi icon values from mapped image names', () => {
     expect(getEffectiveDisplayIcon('mdi:docker', 'library/nginx:latest')).toBe('sh-nginx');
     expect(getEffectiveDisplayIcon('mdi-docker', 'bitnami/postgres:16')).toBe('sh-postgresql');

From f089d0ee0fee6b7d5164a3288c1415fdeef915aa Mon Sep 17 00:00:00 2001
From: superuserjr <80784472+turbodaemon@users.noreply.github.com>
Date: Tue, 10 Mar 2026 10:17:31 -0400
Subject: [PATCH 23/34] =?UTF-8?q?=F0=9F=90=9B=20fix(api):=20include=20dock?=
 =?UTF-8?q?ercompose=20in=20default=20trigger=20type=20search?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Change DEFAULT_TRIGGER_TYPES from ['docker'] to ['docker', 'dockercompose']
so rollbackContainer and webhook update endpoints find compose triggers.
The updateContainer and previewContainer endpoints already had this fix.
---
 app/api/backup.test.ts         | 49 ++++++++++++++++++++++++++++++++++
 app/api/docker-trigger.test.ts | 10 +++----
 app/api/docker-trigger.ts      |  2 +-
 app/api/webhook.test.ts        | 22 +++++++++++++++
 4 files changed, 77 insertions(+), 6 deletions(-)

diff --git a/app/api/backup.test.ts b/app/api/backup.test.ts
index fa3ed84f..209b132b 100644
--- a/app/api/backup.test.ts
+++ b/app/api/backup.test.ts
@@ -306,6 +306,55 @@ describe('Backup Router', () => {
       );
     });
 
+    test('should rollback successfully with a dockercompose trigger', async () => {
+      const handler = getHandler('post', '/:id/rollback');
+      const container = {
+        id: 'c1',
+        name: 'nginx',
+        image: { registry: { name: 'hub' } },
+      };
+      const latestBackup = {
+        id: 'b1',
+        containerId: 'c1',
+        imageName: 'library/nginx',
+        imageTag: '1.24',
+      };
+
+      mockGetContainer.mockReturnValue(container);
+      mockGetBackupsByName.mockReturnValue([latestBackup]);
+
+      const mockCurrentContainer = {};
+      const mockContainerSpec = { State: { Running: true } };
+      const composeTrigger = {
+        type: 'dockercompose',
+        getWatcher: vi.fn(() => ({ dockerApi: {} })),
+        pullImage: vi.fn().mockResolvedValue(undefined),
+        getCurrentContainer: vi.fn().mockResolvedValue(mockCurrentContainer),
+        inspectContainer: vi.fn().mockResolvedValue(mockContainerSpec),
+        stopAndRemoveContainer: vi.fn().mockResolvedValue(undefined),
+        recreateContainer: vi.fn().mockResolvedValue(undefined),
+      };
+      mockGetState.mockReturnValue({
+        trigger: { 'dockercompose.default': composeTrigger },
+        registry: { hub: { getAuthPull: vi.fn().mockResolvedValue({}) } },
+      });
+
+      const req = createMockRequest({ params: { id: 'c1' } });
+      const res = createMockResponse();
+      await handler(req, res);
+
+      expect(composeTrigger.pullImage).toHaveBeenCalled();
+      expect(composeTrigger.stopAndRemoveContainer).toHaveBeenCalled();
+      expect(composeTrigger.recreateContainer).toHaveBeenCalled();
+      expect(res.status).toHaveBeenCalledWith(200);
+      expect(res.json).toHaveBeenCalledWith(
+        expect.objectContaining({
+          message: 'Container rolled back successfully',
+          backup: latestBackup,
+        }),
+      );
+    });
+
     test('should rollback successfully when a valid backupId is provided', async () => {
       const handler = getHandler('post', '/:id/rollback');
       const container = {
diff --git a/app/api/docker-trigger.test.ts b/app/api/docker-trigger.test.ts
index ba0182d1..82db59d9 100644
--- a/app/api/docker-trigger.test.ts
+++ b/app/api/docker-trigger.test.ts
@@ -26,7 +26,7 @@ describe('docker-trigger helper', () => {
     expect(result).toBeUndefined();
   });
 
-  test('ignores compose triggers by default', () => {
+  test('includes compose triggers by default', () => {
     const composeTrigger = { type: 'dockercompose' };
 
     const result = findDockerTriggerForContainer(
@@ -36,10 +36,10 @@ describe('docker-trigger helper', () => {
       { id: 'c1' },
     );
 
-    expect(result).toBeUndefined();
+    expect(result).toBe(composeTrigger);
   });
 
-  test('can include compose triggers when requested', () => {
+  test('can limit trigger types when requested', () => {
     const composeTrigger = { type: 'dockercompose' };
 
     const result = findDockerTriggerForContainer(
@@ -47,10 +47,10 @@ describe('docker-trigger helper', () => {
         'dockercompose.default': composeTrigger,
       },
       { id: 'c1' },
-      { triggerTypes: ['docker', 'dockercompose'] },
+      { triggerTypes: ['docker'] },
     );
 
-    expect(result).toBe(composeTrigger);
+    expect(result).toBeUndefined();
   });
 
   test('skips docker triggers with a different agent than the container', () => {
diff --git a/app/api/docker-trigger.ts b/app/api/docker-trigger.ts
index bb36d37f..c5116f47 100644
--- a/app/api/docker-trigger.ts
+++ b/app/api/docker-trigger.ts
@@ -3,7 +3,7 @@ import type Docker from '../triggers/providers/docker/Docker.js';
 import type Trigger from '../triggers/providers/Trigger.js';
 
 export const NO_DOCKER_TRIGGER_FOUND_ERROR = 'No docker trigger found for this container';
-const DEFAULT_TRIGGER_TYPES = ['docker'];
+const DEFAULT_TRIGGER_TYPES = ['docker', 'dockercompose'];
 
 interface FindDockerTriggerForContainerOptions {
   triggerTypes?: string[];
diff --git a/app/api/webhook.test.ts b/app/api/webhook.test.ts
index e722f5f9..6da66220 100644
--- a/app/api/webhook.test.ts
+++ b/app/api/webhook.test.ts
@@ -1051,6 +1051,28 @@ describe('Webhook Router', () => {
       });
     });
 
+    test('should trigger update and return 200 with a dockercompose trigger', async () => {
+      const container = { name: 'my-nginx', image: { name: 'nginx' } };
+      mockGetContainers.mockReturnValue([container]);
+      const mockTrigger = vi.fn().mockResolvedValue(undefined);
+      mockGetState.mockReturnValue({
+        watcher: {},
+        trigger: { 'dockercompose.default': { type: 'dockercompose', trigger: mockTrigger } },
+      });
+
+      const handler = getHandler('post', '/update/:containerName');
+      const req = createMockRequest({ params: { containerName: 'my-nginx' } });
+      const res = createMockResponse();
+      await handler(req, res);
+
+      expect(mockTrigger).toHaveBeenCalledWith(container);
+      expect(res.status).toHaveBeenCalledWith(200);
+      expect(res.json).toHaveBeenCalledWith({
+        message: 'Update triggered for container my-nginx',
+        result: { container: 'my-nginx' },
+      });
+    });
+
     test('should sanitize reflected containerName in successful update response', async () => {
       const containerName = '\u001b[31mmy-nginx\u001b[0m\nnext';
       const container = { name: containerName, image: { name: 'nginx' } };

From ef0d1b3da3ef584a28abb9d292ab8a2ef5d891e3 Mon Sep 17 00:00:00 2001
From: superuserjr <80784472+turbodaemon@users.noreply.github.com>
Date: Tue, 10 Mar 2026 10:17:45 -0400
Subject: [PATCH 24/34] =?UTF-8?q?=F0=9F=90=9B=20fix(ui):=20normalize=20nes?=
 =?UTF-8?q?ted=20icon=20prefixes=20before=20proxy=20request?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The si: prefix was leaking into API requests as si-si:nextcloud causing
slug validation failures. Extract normalizeIconPrefix to image-icon
service with recursive unwrapping of nested prefixes.
---
 ui/src/components/ContainerIcon.vue       |  8 +++-----
 ui/src/services/image-icon.ts             | 22 +++++++++++++++++-----
 ui/tests/components/ContainerIcon.spec.ts |  7 +++++++
 ui/tests/services/image-icon.spec.ts      |  1 +
 4 files changed, 28 insertions(+), 10 deletions(-)

diff --git a/ui/src/components/ContainerIcon.vue b/ui/src/components/ContainerIcon.vue
index a0fe7585..5cac03f3 100644
--- a/ui/src/components/ContainerIcon.vue
+++ b/ui/src/components/ContainerIcon.vue
@@ -1,5 +1,6 @@
 <script setup lang="ts">
 import { computed, ref } from 'vue';
+import { normalizeIconPrefix } from '../services/image-icon';
 
 const props = withDefaults(
   defineProps<{
@@ -23,13 +24,10 @@ const failed = ref(false);
  *   other       → treat as selfhst slug
  */
 const resolved = computed(() => {
-  // Normalize colon-separated prefixes (sh:slug → sh-slug)
   const raw = props.icon;
   if (!raw) return { type: 'fallback' as const };
-  const icon =
-    raw.startsWith('sh:') || raw.startsWith('hl:') || raw.startsWith('si:')
-      ? `${raw.slice(0, 2)}-${raw.slice(3)}`
-      : raw;
+  const icon = normalizeIconPrefix(raw);
+  if (!icon) return { type: 'fallback' as const };
 
   if (icon.startsWith('sh-')) {
     return { type: 'proxy' as const, src: `/api/icons/selfhst/${icon.slice(3)}` };
diff --git a/ui/src/services/image-icon.ts b/ui/src/services/image-icon.ts
index e9445878..4c96e869 100644
--- a/ui/src/services/image-icon.ts
+++ b/ui/src/services/image-icon.ts
@@ -19,11 +19,23 @@ function isLegacyOrDefaultIcon(displayIcon: string): boolean {
 }
 
 /** Normalize colon-separated icon prefixes (sh:slug) to dash format (sh-slug). */
-function normalizeIconPrefix(icon: string): string {
-  if (icon.startsWith('sh:')) return `sh-${icon.slice(3)}`;
-  if (icon.startsWith('hl:')) return `hl-${icon.slice(3)}`;
-  if (icon.startsWith('si:')) return `si-${icon.slice(3)}`;
-  return icon;
+export function normalizeIconPrefix(icon: string): string {
+  const normalized = icon.trim();
+  const match = normalized.match(/^(sh|hl|si)[:-](.+)$/i);
+  if (!match) {
+    return normalized;
+  }
+  const provider = match[1].toLowerCase();
+  let slug = match[2].trim();
+
+  // Handle malformed nested values like "si-si:nextcloud" by unwrapping known prefixes.
+  let nestedMatch = slug.match(/^(sh|hl|si)[:-](.+)$/i);
+  while (nestedMatch) {
+    slug = nestedMatch[2].trim();
+    nestedMatch = slug.match(/^(sh|hl|si)[:-](.+)$/i);
+  }
+
+  return `${provider}-${slug}`;
 }
 
 /**
diff --git a/ui/tests/components/ContainerIcon.spec.ts b/ui/tests/components/ContainerIcon.spec.ts
index 530a27fa..ee56897b 100644
--- a/ui/tests/components/ContainerIcon.spec.ts
+++ b/ui/tests/components/ContainerIcon.spec.ts
@@ -55,6 +55,13 @@ describe('ContainerIcon', () => {
     expect(img.attributes('src')).toBe('/api/icons/simple/docker');
   });
 
+  it('normalizes nested si prefixes so proxy slug never contains a colon', () => {
+    const wrapper = factory({ icon: 'si-si:nextcloud' });
+    const img = wrapper.find('img');
+    expect(img.exists()).toBe(true);
+    expect(img.attributes('src')).toBe('/api/icons/simple/nextcloud');
+  });
+
   it('renders direct URL for http:// prefix', () => {
     const wrapper = factory({ icon: 'http://example.com/icon.png' });
     const img = wrapper.find('img');
diff --git a/ui/tests/services/image-icon.spec.ts b/ui/tests/services/image-icon.spec.ts
index 18eb9ee3..44bfd812 100644
--- a/ui/tests/services/image-icon.spec.ts
+++ b/ui/tests/services/image-icon.spec.ts
@@ -12,6 +12,7 @@ describe('image-icon service', () => {
     );
     expect(getEffectiveDisplayIcon('hl:nginx', 'library/nginx')).toBe('hl-nginx');
     expect(getEffectiveDisplayIcon('si:docker', 'library/nginx')).toBe('si-docker');
+    expect(getEffectiveDisplayIcon('si-si:nextcloud', 'library/nginx')).toBe('si-nextcloud');
   });
 
   it('auto-resolves legacy mdi icon values from mapped image names', () => {

From 0b96f5104e579339df56027de0af6a696621a7a9 Mon Sep 17 00:00:00 2001
From: superuserjr <80784472+turbodaemon@users.noreply.github.com>
Date: Tue, 10 Mar 2026 10:18:03 -0400
Subject: [PATCH 25/34] =?UTF-8?q?=F0=9F=90=9B=20fix(docker):=20reconcile?=
 =?UTF-8?q?=20container=20names=20after=20external=20recreate?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When a container is recreated externally (Portainer, docker compose up),
the old store entry becomes stale. Add name refresh during watch cycles,
stale same-name entry cleanup on new container discovery, and debounced
watch on rename events for race condition handling.
---
 app/watchers/providers/docker/Docker.test.ts  | 27 +++++++
 app/watchers/providers/docker/Docker.ts       | 14 ++++
 .../docker/container-event-update.test.ts     | 21 ++++++
 .../docker/container-event-update.ts          |  4 ++
 ...docker-image-details-orchestration.test.ts | 70 +++++++++++++++++++
 .../docker-image-details-orchestration.ts     | 34 +++++++--
 6 files changed, 165 insertions(+), 5 deletions(-)

diff --git a/app/watchers/providers/docker/Docker.test.ts b/app/watchers/providers/docker/Docker.test.ts
index c7cd0387..22e96592 100644
--- a/app/watchers/providers/docker/Docker.test.ts
+++ b/app/watchers/providers/docker/Docker.test.ts
@@ -5526,6 +5526,33 @@ describe('Docker Watcher', () => {
         }),
       );
     });
+
+    test('pruneOldContainers should delete stale entries when a same-name replacement exists', async () => {
+      const dockerApi = {
+        getContainer: vi.fn(),
+      };
+
+      await testable_pruneOldContainers(
+        [
+          {
+            id: 'new-1',
+            watcher: 'docker',
+            name: 'app',
+          },
+        ] as any,
+        [
+          {
+            id: 'old-1',
+            watcher: 'docker',
+            name: 'app',
+          },
+        ] as any,
+        dockerApi as any,
+      );
+
+      expect(dockerApi.getContainer).not.toHaveBeenCalled();
+      expect(storeContainer.deleteContainer).toHaveBeenCalledWith('old-1');
+    });
   });
 
   describe('Additional Coverage - maintenance queue internals', () => {
diff --git a/app/watchers/providers/docker/Docker.ts b/app/watchers/providers/docker/Docker.ts
index a21afe7d..c62c96f8 100644
--- a/app/watchers/providers/docker/Docker.ts
+++ b/app/watchers/providers/docker/Docker.ts
@@ -320,7 +320,21 @@ async function pruneOldContainers(
   dockerApi: DockerApiContainerInspector,
 ) {
   const containersToRemove = getOldContainers(newContainers, containersFromTheStore);
+  const newContainerNameKeys = new Set(
+    newContainers
+      .filter((container) => typeof container.name === 'string' && container.name !== '')
+      .map((container) => `${container.watcher || ''}::${container.name}`),
+  );
   for (const containerToRemove of containersToRemove) {
+    const staleContainerNameKey = `${containerToRemove.watcher || ''}::${containerToRemove.name || ''}`;
+    if (
+      typeof containerToRemove.name === 'string' &&
+      containerToRemove.name !== '' &&
+      newContainerNameKeys.has(staleContainerNameKey)
+    ) {
+      storeContainer.deleteContainer(containerToRemove.id);
+      continue;
+    }
     try {
       const inspectResult = await dockerApi.getContainer(containerToRemove.id).inspect();
       const newStatus = inspectResult?.State?.Status;
diff --git a/app/watchers/providers/docker/container-event-update.test.ts b/app/watchers/providers/docker/container-event-update.test.ts
index 5f99d533..6340a911 100644
--- a/app/watchers/providers/docker/container-event-update.test.ts
+++ b/app/watchers/providers/docker/container-event-update.test.ts
@@ -86,6 +86,27 @@ describe('container event update helpers', () => {
     );
   });
 
+  test('processDockerEvent schedules a debounced watch for rename events when container is not in store', async () => {
+    const watchCronDebounced = vi.fn().mockResolvedValue(undefined);
+
+    await processDockerEvent(
+      { Action: 'rename', id: 'container123' },
+      {
+        watchCronDebounced,
+        ensureRemoteAuthHeaders: vi.fn().mockResolvedValue(undefined),
+        inspectContainer: vi.fn().mockResolvedValue({
+          Name: '/renamed-container',
+          State: { Status: 'running' },
+        }),
+        getContainerFromStore: vi.fn().mockReturnValue(undefined),
+        updateContainerFromInspect: vi.fn(),
+        debug: vi.fn(),
+      },
+    );
+
+    expect(watchCronDebounced).toHaveBeenCalledTimes(1);
+  });
+
   test('updateContainerFromInspect updates status/name/displayName and persists', () => {
     const container = createMockContainer({
       status: 'stopped',
diff --git a/app/watchers/providers/docker/container-event-update.ts b/app/watchers/providers/docker/container-event-update.ts
index d2f89018..317eb1f4 100644
--- a/app/watchers/providers/docker/container-event-update.ts
+++ b/app/watchers/providers/docker/container-event-update.ts
@@ -34,6 +34,10 @@ export async function processDockerEvent(
 
     if (containerFound) {
       dependencies.updateContainerFromInspect(containerFound, containerInspect);
+    } else if (action === 'rename') {
+      // Rename can race with create and happen before the new container is in store.
+      // Schedule a full refresh so the final human-readable name is captured.
+      await dependencies.watchCronDebounced();
     }
   } catch (e: any) {
     dependencies.debug(
diff --git a/app/watchers/providers/docker/docker-image-details-orchestration.test.ts b/app/watchers/providers/docker/docker-image-details-orchestration.test.ts
index 00ff9063..595eaee9 100644
--- a/app/watchers/providers/docker/docker-image-details-orchestration.test.ts
+++ b/app/watchers/providers/docker/docker-image-details-orchestration.test.ts
@@ -242,6 +242,46 @@ describe('docker image details orchestration module', () => {
     expect(containerInStore.status).toBe('running');
   });
 
+  test('refreshes cached container name from Docker summary when it changes', async () => {
+    const containerInStore = {
+      id: 'container-1',
+      name: 'temp-name-123',
+      displayName: 'temp-name-123',
+      status: 'running',
+      error: undefined,
+      details: {
+        ports: [],
+        volumes: [],
+        env: [],
+      },
+      image: {
+        name: 'acme/service',
+        id: 'image-old',
+        digest: {
+          repo: 'sha256:old',
+          value: 'sha256:old',
+        },
+        created: '2025-01-01T00:00:00.000Z',
+      },
+    };
+    vi.spyOn(storeContainer, 'getContainer').mockReturnValue(containerInStore as any);
+
+    const { watcher } = createWatcher({
+      configuration: { watchevents: true },
+    });
+
+    const result = await addImageDetailsToContainerOrchestration(
+      watcher as any,
+      createDockerSummaryContainer({ Names: ['/service'] }),
+      {},
+      createHelpers() as any,
+    );
+
+    expect(result).toBe(containerInStore);
+    expect(containerInStore.name).toBe('service');
+    expect(containerInStore.displayName).toBe('service');
+  });
+
   test('throws a clear error when image inspection fails for a new container', async () => {
     vi.spyOn(storeContainer, 'getContainer').mockReturnValue(undefined);
 
@@ -429,4 +469,34 @@ describe('docker image details orchestration module', () => {
     });
     expect(watcher.log.warn).not.toHaveBeenCalled();
   });
+
+  test('removes stale same-name container entries when a new container id is discovered', async () => {
+    vi.spyOn(storeContainer, 'getContainer').mockReturnValue(undefined);
+    const getContainersSpy = vi.spyOn(storeContainer, 'getContainers').mockReturnValue([
+      {
+        id: 'old-container-id',
+        watcher: 'docker-test',
+        name: 'service',
+      } as any,
+    ]);
+    const deleteContainerSpy = vi
+      .spyOn(storeContainer, 'deleteContainer')
+      .mockImplementation(() => {});
+
+    const { watcher } = createWatcher();
+
+    const result = await addImageDetailsToContainerOrchestration(
+      watcher as any,
+      createDockerSummaryContainer({
+        Id: 'new-container-id',
+        Names: ['/service'],
+      }),
+      {},
+      createHelpers() as any,
+    );
+
+    expect(result?.id).toBe('new-container-id');
+    expect(getContainersSpy).toHaveBeenCalledWith({ watcher: 'docker-test', name: 'service' });
+    expect(deleteContainerSpy).toHaveBeenCalledWith('old-container-id');
+  });
 });
diff --git a/app/watchers/providers/docker/docker-image-details-orchestration.ts b/app/watchers/providers/docker/docker-image-details-orchestration.ts
index 33412ada..58076599 100644
--- a/app/watchers/providers/docker/docker-image-details-orchestration.ts
+++ b/app/watchers/providers/docker/docker-image-details-orchestration.ts
@@ -7,6 +7,7 @@ import {
   getRepoDigest,
   isDigestToWatch,
   type ResolvedImgset,
+  shouldUpdateDisplayNameFromContainerName,
 } from './docker-helpers.js';
 import {
   areRuntimeDetailsEqual,
@@ -153,6 +154,7 @@ export async function addImageDetailsToContainerOrchestration(
 ): Promise<Container | undefined> {
   const containerId = container.Id;
   const containerLabels: Record<string, string> = container.Labels || {};
+  const dockerContainerName = getContainerName(container);
   const runtimeDetailsFromSummary = getRuntimeDetailsFromContainerSummary(container);
 
   // Is container already in store? Refresh volatile image fields, then return it
@@ -160,6 +162,21 @@ export async function addImageDetailsToContainerOrchestration(
   if (containerInStore !== undefined && containerInStore.error === undefined) {
     watcher.ensureLogger();
     watcher.log.debug(`Container ${containerInStore.id} already in store`);
+    const existingName = containerInStore.name || '';
+    if (dockerContainerName !== '' && existingName !== dockerContainerName) {
+      const shouldUpdateDisplayName = shouldUpdateDisplayNameFromContainerName(
+        dockerContainerName,
+        existingName,
+        containerInStore.displayName,
+      );
+      containerInStore.name = dockerContainerName;
+      if (shouldUpdateDisplayName) {
+        containerInStore.displayName = getContainerDisplayName(
+          dockerContainerName,
+          containerInStore.image?.name || '',
+        );
+      }
+    }
     const cachedRuntimeDetails = normalizeRuntimeDetails(containerInStore.details);
     let runtimeDetailsToApply = mergeRuntimeDetails(
       runtimeDetailsFromSummary,
@@ -273,16 +290,15 @@ export async function addImageDetailsToContainerOrchestration(
   } catch {
     // Degrade gracefully to summary details.
   }
-  const containerName = getContainerName(container);
   if (!isSemver && !watchDigest) {
     watcher.ensureLogger();
     watcher.log.warn(
-      `Image is not a semver and digest watching is disabled so drydock won't report any update for container "${containerName}". Please review the configuration to enable digest watching for this container or exclude this container from being watched`,
+      `Image is not a semver and digest watching is disabled so drydock won't report any update for container "${dockerContainerName}". Please review the configuration to enable digest watching for this container or exclude this container from being watched`,
     );
   }
-  return helpers.normalizeContainer({
+  const containerToReturn = helpers.normalizeContainer({
     id: containerId,
-    name: containerName,
+    name: dockerContainerName,
     status: container.State,
     watcher: watcher.name,
     includeTags: resolvedConfig.includeTags,
@@ -291,7 +307,7 @@ export async function addImageDetailsToContainerOrchestration(
     tagFamily: resolvedConfig.tagFamily,
     linkTemplate: resolvedConfig.linkTemplate,
     displayName: getContainerDisplayName(
-      containerName,
+      dockerContainerName,
       parsedImage.path,
       resolvedConfig.displayName,
     ),
@@ -328,4 +344,12 @@ export async function addImageDetailsToContainerOrchestration(
     updateAvailable: false,
     updateKind: { kind: 'unknown' },
   } as Container);
+  const containersWithSameName = storeContainer.getContainers({
+    watcher: watcher.name,
+    name: containerToReturn.name,
+  });
+  containersWithSameName
+    .filter((staleContainer) => staleContainer.id !== containerToReturn.id)
+    .forEach((staleContainer) => storeContainer.deleteContainer(staleContainer.id));
+  return containerToReturn;
 }

From efb5626c608aa80cf70c45deb5344cc8accf7856 Mon Sep 17 00:00:00 2001
From: superuserjr <80784472+turbodaemon@users.noreply.github.com>
Date: Tue, 10 Mar 2026 10:18:21 -0400
Subject: [PATCH 26/34] =?UTF-8?q?=E2=9C=A8=20feat(mqtt):=20add=20HASS=5FFI?=
 =?UTF-8?q?LTER=5FINCLUDE=20and=20HASS=5FFILTER=5FEXCLUDE=20options?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Implement native include/exclude filtering for MQTT payloads operating
on flattened keys. Include mode keeps only listed keys; exclude mode
removes them. Both take precedence over legacy EXCLUDE and HASS_ATTRIBUTES
preset. Also fix handleContainerEvent bypassing mustTrigger() check.
---
 app/triggers/providers/mqtt/Mqtt.test.ts   | 169 ++++++++++++++++++++-
 app/triggers/providers/mqtt/Mqtt.ts        |  96 ++++++++++--
 app/triggers/providers/mqtt/filter.test.ts |  50 +++++-
 app/triggers/providers/mqtt/filter.ts      |  28 ++++
 4 files changed, 324 insertions(+), 19 deletions(-)

diff --git a/app/triggers/providers/mqtt/Mqtt.test.ts b/app/triggers/providers/mqtt/Mqtt.test.ts
index 2fb40e83..7eb5e800 100644
--- a/app/triggers/providers/mqtt/Mqtt.test.ts
+++ b/app/triggers/providers/mqtt/Mqtt.test.ts
@@ -32,6 +32,10 @@ const configurationValid = {
     enabled: false,
     prefix: 'homeassistant',
     attributes: 'full',
+    filter: {
+      include: '',
+      exclude: '',
+    },
   },
   tls: {
     clientkey: undefined,
@@ -112,6 +116,10 @@ test('validateConfiguration should default hass.discovery to true when hass.enab
     prefix: 'homeassistant',
     discovery: true,
     attributes: 'full',
+    filter: {
+      include: '',
+      exclude: '',
+    },
   });
 });
 
@@ -157,6 +165,11 @@ test('initTrigger should init Mqtt client', async () => {
       enabled: true,
       discovery: true,
       prefix: 'homeassistant',
+      attributes: 'full',
+      filter: {
+        include: '',
+        exclude: '',
+      },
     },
   };
   const spy = vi.spyOn(mqttClient, 'connectAsync');
@@ -176,7 +189,13 @@ test.each(containerData)('trigger should format json message payload as expected
   mqtt.configuration = {
     topic: 'dd/container',
     exclude: '',
-    hass: { attributes: 'full' },
+    hass: {
+      attributes: 'full',
+      filter: {
+        include: '',
+        exclude: '',
+      },
+    },
   };
   const container = {
     id: '31a61a8305ef1fc9a71fa4f20a68d7ec88b28e32303bbc4a5f192e851165b816',
@@ -225,7 +244,16 @@ test('initTrigger should read TLS files when configured', async () => {
       cachain: '/path/to/ca.pem',
       rejectunauthorized: false,
     },
-    hass: { enabled: false },
+    hass: {
+      enabled: false,
+      discovery: false,
+      prefix: 'homeassistant',
+      attributes: 'full',
+      filter: {
+        include: '',
+        exclude: '',
+      },
+    },
   };
   await mqtt.initTrigger();
 
@@ -259,11 +287,31 @@ test('handleContainerEvent should log when trigger fails', async () => {
   expect(debugSpy).toHaveBeenCalledWith(expect.any(Error));
 });
 
+test('handleContainerEvent should skip trigger when mustTrigger is false', async () => {
+  const mustTriggerSpy = vi.spyOn(mqtt, 'mustTrigger').mockReturnValue(false);
+  const triggerSpy = vi.spyOn(mqtt, 'trigger').mockResolvedValue(undefined);
+
+  mqtt.handleContainerEvent({ name: 'ignored', watcher: 'local' });
+  await Promise.resolve();
+
+  expect(mustTriggerSpy).toHaveBeenCalledWith({ name: 'ignored', watcher: 'local' });
+  expect(triggerSpy).not.toHaveBeenCalled();
+});
+
 test('initTrigger should execute registered container event callbacks', async () => {
   mqtt.configuration = {
     ...configurationValid,
     clientid: 'dd',
-    hass: { enabled: false, discovery: false, prefix: 'homeassistant' },
+    hass: {
+      enabled: false,
+      discovery: false,
+      prefix: 'homeassistant',
+      attributes: 'full',
+      filter: {
+        include: '',
+        exclude: '',
+      },
+    },
   };
   vi.spyOn(mqttClient, 'connectAsync').mockResolvedValue({
     publish: vi.fn().mockResolvedValue(undefined),
@@ -283,7 +331,16 @@ test('deregister then initTrigger should not duplicate container event callbacks
   mqtt.configuration = {
     ...configurationValid,
     clientid: 'dd',
-    hass: { enabled: false, discovery: false, prefix: 'homeassistant' },
+    hass: {
+      enabled: false,
+      discovery: false,
+      prefix: 'homeassistant',
+      attributes: 'full',
+      filter: {
+        include: '',
+        exclude: '',
+      },
+    },
   };
   vi.spyOn(mqttClient, 'connectAsync').mockResolvedValue({
     publish: vi.fn().mockResolvedValue(undefined),
@@ -329,6 +386,36 @@ describe('hass.attributes validation', () => {
   });
 });
 
+describe('hass.filter validation', () => {
+  test('should default hass.filter include and exclude to empty strings', () => {
+    const validated = mqtt.validateConfiguration({
+      url: configurationValid.url,
+      clientid: 'dd',
+    });
+    expect(validated.hass.filter).toStrictEqual({
+      include: '',
+      exclude: '',
+    });
+  });
+
+  test('should accept hass.filter include and exclude', () => {
+    const validated = mqtt.validateConfiguration({
+      url: configurationValid.url,
+      clientid: 'dd',
+      hass: {
+        filter: {
+          include: 'name,image_name,result_tag',
+          exclude: 'security_sbom_documents_0_spdx_version',
+        },
+      },
+    });
+    expect(validated.hass.filter).toStrictEqual({
+      include: 'name,image_name,result_tag',
+      exclude: 'security_sbom_documents_0_spdx_version',
+    });
+  });
+});
+
 describe('exclude validation', () => {
   test('should accept exclude as comma-separated string', () => {
     const validated = mqtt.validateConfiguration({
@@ -392,7 +479,13 @@ describe('trigger filtering', () => {
     mqtt.configuration = {
       topic: 'dd/container',
       exclude: '',
-      hass: { attributes: 'short' },
+      hass: {
+        attributes: 'short',
+        filter: {
+          include: '',
+          exclude: '',
+        },
+      },
     };
     await mqtt.trigger(containerWithSecurity);
 
@@ -409,7 +502,13 @@ describe('trigger filtering', () => {
     mqtt.configuration = {
       topic: 'dd/container',
       exclude: '',
-      hass: { attributes: 'full' },
+      hass: {
+        attributes: 'full',
+        filter: {
+          include: '',
+          exclude: '',
+        },
+      },
     };
     await mqtt.trigger(containerWithSecurity);
 
@@ -423,7 +522,13 @@ describe('trigger filtering', () => {
     mqtt.configuration = {
       topic: 'dd/container',
       exclude: 'details',
-      hass: { attributes: 'short' },
+      hass: {
+        attributes: 'short',
+        filter: {
+          include: '',
+          exclude: '',
+        },
+      },
     };
     await mqtt.trigger(containerWithSecurity);
 
@@ -434,11 +539,59 @@ describe('trigger filtering', () => {
     expect(publishedPayload).toHaveProperty('security_scan_vulnerabilities_0_id', 'CVE-2024-0001');
   });
 
+  test('should use hass.filter.include over all other filters when set', async () => {
+    mqtt.configuration = {
+      topic: 'dd/container',
+      exclude: 'details',
+      hass: {
+        attributes: 'short',
+        filter: {
+          include: 'name,image_name,result_tag',
+          exclude: 'security_scan_vulnerabilities_0_id',
+        },
+      },
+    };
+    await mqtt.trigger(containerWithSecurity);
+
+    const publishedPayload = JSON.parse(mqtt.client.publish.mock.calls[0][1]);
+    expect(publishedPayload).toEqual({
+      name: 'filtered-test',
+      image_name: 'nginx',
+      result_tag: '1.26',
+    });
+  });
+
+  test('should use hass.filter.exclude over legacy exclude and hass.attributes', async () => {
+    mqtt.configuration = {
+      topic: 'dd/container',
+      exclude: 'details',
+      hass: {
+        attributes: 'short',
+        filter: {
+          include: '',
+          exclude: 'security_sbom_documents_0_spdx_version',
+        },
+      },
+    };
+    await mqtt.trigger(containerWithSecurity);
+
+    const publishedPayload = JSON.parse(mqtt.client.publish.mock.calls[0][1]);
+    expect(publishedPayload).not.toHaveProperty('security_sbom_documents_0_spdx_version');
+    expect(publishedPayload).toHaveProperty('details_ports_0', '80/tcp');
+    expect(publishedPayload).toHaveProperty('security_scan_vulnerabilities_0_id', 'CVE-2024-0001');
+  });
+
   test('should publish full container when both are default', async () => {
     mqtt.configuration = {
       topic: 'dd/container',
       exclude: '',
-      hass: { attributes: 'full' },
+      hass: {
+        attributes: 'full',
+        filter: {
+          include: '',
+          exclude: '',
+        },
+      },
     };
     await mqtt.trigger(containerWithSecurity);
 
diff --git a/app/triggers/providers/mqtt/Mqtt.ts b/app/triggers/providers/mqtt/Mqtt.ts
index a13d6c38..50e80ca9 100644
--- a/app/triggers/providers/mqtt/Mqtt.ts
+++ b/app/triggers/providers/mqtt/Mqtt.ts
@@ -7,6 +7,7 @@ import { resolveConfiguredPath } from '../../../runtime/paths.js';
 import Trigger, { type TriggerConfiguration } from '../Trigger.js';
 import {
   filterContainer,
+  filterContainerInclude,
   HASS_ATTRIBUTE_PRESET_VALUES,
   HASS_ATTRIBUTE_PRESETS,
   type HassAttributePreset,
@@ -43,6 +44,10 @@ interface MqttConfiguration extends TriggerConfiguration {
     prefix: string;
     discovery: boolean;
     attributes: HassAttributePreset;
+    filter: {
+      include: string;
+      exclude: string;
+    };
   };
   tls: {
     clientkey?: string;
@@ -52,6 +57,22 @@ interface MqttConfiguration extends TriggerConfiguration {
   };
 }
 
+interface MqttFilterConfig {
+  mode: 'include' | 'exclude';
+  stage: 'container' | 'flattened';
+  paths: string[];
+}
+
+function splitFilterPaths(value: string | undefined): string[] {
+  if (!value) {
+    return [];
+  }
+  return value
+    .split(',')
+    .map((path) => path.trim())
+    .filter(Boolean);
+}
+
 /**
  * MQTT Trigger implementation
  */
@@ -66,6 +87,10 @@ class Mqtt extends Trigger {
       prefix: hassDefaultPrefix,
       discovery: false,
       attributes: 'full',
+      filter: {
+        include: '',
+        exclude: '',
+      },
     },
     tls: {
       rejectunauthorized: true,
@@ -85,6 +110,9 @@ class Mqtt extends Trigger {
   }
 
   handleContainerEvent(container) {
+    if (!this.mustTrigger(container)) {
+      return;
+    }
     void this.trigger(container).catch((error) => {
       this.log.warn(`Error (${error.message})`);
       this.log.debug(error);
@@ -117,12 +145,25 @@ class Mqtt extends Trigger {
             .string()
             .valid(...HASS_ATTRIBUTE_PRESET_VALUES)
             .default('full'),
+          filter: this.joi
+            .object({
+              include: this.joi.string().allow('').default(''),
+              exclude: this.joi.string().allow('').default(''),
+            })
+            .default({
+              include: '',
+              exclude: '',
+            }),
         })
         .default({
           enabled: false,
           prefix: hassDefaultPrefix,
           discovery: false,
           attributes: 'full',
+          filter: {
+            include: '',
+            exclude: '',
+          },
         }),
       tls: this.joi
         .object({
@@ -214,14 +255,39 @@ class Mqtt extends Trigger {
     await super.deregisterComponent();
   }
 
-  getExcludePaths(): string[] {
-    if (this.configuration.exclude) {
-      return this.configuration.exclude
-        .split(',')
-        .map((s) => s.trim())
-        .filter(Boolean);
+  getFilterConfig(): MqttFilterConfig {
+    const includePaths = splitFilterPaths(this.configuration.hass?.filter?.include);
+    if (includePaths.length > 0) {
+      return {
+        mode: 'include',
+        stage: 'flattened',
+        paths: includePaths,
+      };
     }
-    return HASS_ATTRIBUTE_PRESETS[this.configuration.hass.attributes];
+
+    const hassExcludePaths = splitFilterPaths(this.configuration.hass?.filter?.exclude);
+    if (hassExcludePaths.length > 0) {
+      return {
+        mode: 'exclude',
+        stage: 'flattened',
+        paths: hassExcludePaths,
+      };
+    }
+
+    const legacyExcludePaths = splitFilterPaths(this.configuration.exclude);
+    if (legacyExcludePaths.length > 0) {
+      return {
+        mode: 'exclude',
+        stage: 'container',
+        paths: legacyExcludePaths,
+      };
+    }
+
+    return {
+      mode: 'exclude',
+      stage: 'container',
+      paths: HASS_ATTRIBUTE_PRESETS[this.configuration.hass?.attributes ?? 'full'],
+    };
   }
 
   /**
@@ -236,11 +302,21 @@ class Mqtt extends Trigger {
       container,
     });
 
-    const excludePaths = this.getExcludePaths();
-    const containerToPublish = filterContainer(container, excludePaths);
+    const filterConfig = this.getFilterConfig();
+    const containerToPublish =
+      filterConfig.stage === 'container'
+        ? filterContainer(container, filterConfig.paths)
+        : container;
+    const flattenedContainer = flatten(containerToPublish);
+    const containerToPublishFlattened =
+      filterConfig.stage === 'flattened'
+        ? filterConfig.mode === 'include'
+          ? filterContainerInclude(flattenedContainer, filterConfig.paths)
+          : filterContainer(flattenedContainer, filterConfig.paths)
+        : flattenedContainer;
 
     this.log.debug(`Publish container result to ${containerTopic}`);
-    return this.client.publish(containerTopic, JSON.stringify(flatten(containerToPublish)), {
+    return this.client.publish(containerTopic, JSON.stringify(containerToPublishFlattened), {
       retain: true,
     });
   }
diff --git a/app/triggers/providers/mqtt/filter.test.ts b/app/triggers/providers/mqtt/filter.test.ts
index d8d7edf6..5c8dffbc 100644
--- a/app/triggers/providers/mqtt/filter.test.ts
+++ b/app/triggers/providers/mqtt/filter.test.ts
@@ -1,4 +1,9 @@
-import { filterContainer, HASS_ATTRIBUTE_PRESET_VALUES, HASS_ATTRIBUTE_PRESETS } from './filter.js';
+import {
+  filterContainer,
+  filterContainerInclude,
+  HASS_ATTRIBUTE_PRESET_VALUES,
+  HASS_ATTRIBUTE_PRESETS,
+} from './filter.js';
 
 describe('filterContainer', () => {
   const container = {
@@ -178,6 +183,49 @@ describe('filterContainer', () => {
   });
 });
 
+describe('filterContainerInclude', () => {
+  const flattenedContainer = {
+    name: 'test',
+    watcher: 'local',
+    image_name: 'nginx',
+    result_tag: '1.26',
+    security_scan_status: 'passed',
+    security_scan_vulnerabilities_0_id: 'CVE-2024-0001',
+  };
+
+  test('returns container unchanged (same reference) when includePaths is empty', () => {
+    const result = filterContainerInclude(flattenedContainer, []);
+    expect(result).toBe(flattenedContainer);
+  });
+
+  test('returns primitive input unchanged when includePaths are requested', () => {
+    const result = filterContainerInclude('container-as-string', ['name']);
+    expect(result).toBe('container-as-string');
+  });
+
+  test('keeps only included top-level keys', () => {
+    const result = filterContainerInclude(flattenedContainer, ['name', 'image_name', 'result_tag']);
+    expect(result).toEqual({
+      name: 'test',
+      image_name: 'nginx',
+      result_tag: '1.26',
+    });
+  });
+
+  test('ignores include keys that do not exist', () => {
+    const result = filterContainerInclude(flattenedContainer, ['name', 'does_not_exist']);
+    expect(result).toEqual({
+      name: 'test',
+    });
+  });
+
+  test('does not mutate the original container', () => {
+    const original = JSON.parse(JSON.stringify(flattenedContainer));
+    filterContainerInclude(flattenedContainer, ['name']);
+    expect(flattenedContainer).toEqual(original);
+  });
+});
+
 describe('HASS_ATTRIBUTE_PRESETS', () => {
   test('full preset has empty exclude list', () => {
     expect(HASS_ATTRIBUTE_PRESETS.full).toEqual([]);
diff --git a/app/triggers/providers/mqtt/filter.ts b/app/triggers/providers/mqtt/filter.ts
index f102dd04..59fc64d7 100644
--- a/app/triggers/providers/mqtt/filter.ts
+++ b/app/triggers/providers/mqtt/filter.ts
@@ -121,3 +121,31 @@ export function filterContainer<T>(container: T, excludePaths: string[]): T {
 
   return clone as T;
 }
+
+/**
+ * Filter a flat container object by keeping only the given top-level keys.
+ * Returns the original container when includePaths is empty (zero overhead).
+ */
+export function filterContainerInclude<T>(container: T, includePaths: string[]): T {
+  if (includePaths.length === 0) {
+    return container;
+  }
+  if (!isRecord(container)) {
+    return container;
+  }
+
+  const sourceRoot = container as Record<string, unknown>;
+  const clone = cloneObjectShallow(sourceRoot);
+  const includeSet = new Set(includePaths);
+
+  for (const key of Reflect.ownKeys(sourceRoot)) {
+    if (typeof key !== 'string') {
+      continue;
+    }
+    if (!includeSet.has(key)) {
+      delete clone[key];
+    }
+  }
+
+  return clone as T;
+}

From 03a1c66aed827492460edad0b1e54d6256665c84 Mon Sep 17 00:00:00 2001
From: superuserjr <80784472+turbodaemon@users.noreply.github.com>
Date: Tue, 10 Mar 2026 10:18:33 -0400
Subject: [PATCH 27/34] =?UTF-8?q?=E2=9C=A8=20feat(oidc):=20add=20CAFILE=20?=
 =?UTF-8?q?and=20INSECURE=20TLS=20options=20for=20OIDC=20discovery?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use openid-client customFetch with undici.Agent to inject TLS settings
per-provider. CAFILE loads a PEM CA certificate for private/self-signed
CAs. INSECURE disables certificate verification (dev only, warns).
---
 .../providers/oidc/Oidc.test.ts               | 136 +++++++++++++++++-
 app/authentications/providers/oidc/Oidc.ts    |  42 +++++-
 app/package-lock.json                         |  10 ++
 app/package.json                              |   1 +
 4 files changed, 183 insertions(+), 6 deletions(-)

diff --git a/app/authentications/providers/oidc/Oidc.test.ts b/app/authentications/providers/oidc/Oidc.test.ts
index 6fb0a40c..58d89aa5 100644
--- a/app/authentications/providers/oidc/Oidc.test.ts
+++ b/app/authentications/providers/oidc/Oidc.test.ts
@@ -1,3 +1,6 @@
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
 import express from 'express';
 import { ClientSecretPost, Configuration } from 'openid-client';
 import * as configuration from '../../../configuration/index.js';
@@ -13,6 +16,18 @@ const configurationValid = {
   timeout: 5000,
 };
 
+async function createTemporaryCaFile(
+  contents = '-----BEGIN CERTIFICATE-----\nTEST\n-----END CERTIFICATE-----\n',
+) {
+  const tempDirectory = await mkdtemp(path.join(os.tmpdir(), 'oidc-ca-'));
+  const caPath = path.join(tempDirectory, 'ca.pem');
+  await writeFile(caPath, contents);
+  return {
+    caPath,
+    cleanup: async () => rm(tempDirectory, { recursive: true, force: true }),
+  };
+}
+
 // --- Factory helpers for repeated test fixtures ---
 
 function createRes(overrides = {}) {
@@ -101,6 +116,7 @@ beforeEach(() => {
     fetchUserInfo: vi.fn(),
     skipSubjectCheck: Symbol('skip-subject-check'),
     ClientSecretPost: vi.fn(),
+    customFetch: Symbol('customFetch'),
     discovery: vi.fn(),
     buildEndSessionUrl: vi.fn(),
   };
@@ -126,7 +142,10 @@ test('validateConfiguration should return validated configuration when valid', a
   configuration.ddEnvVars.DD_PUBLIC_URL = 'https://dd.example.com';
   try {
     const validatedConfiguration = oidc.validateConfiguration(configurationValid);
-    expect(validatedConfiguration).toStrictEqual(configurationValid);
+    expect(validatedConfiguration).toStrictEqual({
+      ...configurationValid,
+      insecure: false,
+    });
   } finally {
     if (previousPublicUrl === undefined) {
       delete configuration.ddEnvVars.DD_PUBLIC_URL;
@@ -168,7 +187,10 @@ test('validateConfiguration should allow optional logouturl override', async ()
       logouturl: 'https://idp.example.com/logout',
     };
     const validatedConfiguration = oidc.validateConfiguration(configWithLogoutUrl);
-    expect(validatedConfiguration).toStrictEqual(configWithLogoutUrl);
+    expect(validatedConfiguration).toStrictEqual({
+      ...configWithLogoutUrl,
+      insecure: false,
+    });
   } finally {
     if (previousPublicUrl === undefined) {
       delete configuration.ddEnvVars.DD_PUBLIC_URL;
@@ -197,6 +219,29 @@ test('validateConfiguration should reject non-http logouturl schemes', async ()
   }
 });
 
+test('validateConfiguration should allow cafile and insecure TLS options', async () => {
+  const previousPublicUrl = configuration.ddEnvVars.DD_PUBLIC_URL;
+  configuration.ddEnvVars.DD_PUBLIC_URL = 'https://dd.example.com';
+  try {
+    const validatedConfiguration = oidc.validateConfiguration({
+      ...configurationValid,
+      cafile: '/certs/private-ca.pem',
+      insecure: true,
+    });
+    expect(validatedConfiguration).toStrictEqual({
+      ...configurationValid,
+      cafile: '/certs/private-ca.pem',
+      insecure: true,
+    });
+  } finally {
+    if (previousPublicUrl === undefined) {
+      delete configuration.ddEnvVars.DD_PUBLIC_URL;
+    } else {
+      configuration.ddEnvVars.DD_PUBLIC_URL = previousPublicUrl;
+    }
+  }
+});
+
 test('getStrategy should return an Authentication strategy', async () => {
   const strategy = oidc.getStrategy(app);
   expect(strategy.name).toEqual('oidc');
@@ -310,6 +355,24 @@ test('maskConfiguration should include configured logouturl', async () => {
   });
 });
 
+test('maskConfiguration should mask configured cafile', async () => {
+  oidc.configuration = {
+    ...configurationValid,
+    cafile: '/etc/ssl/private/oidc-ca.pem',
+    insecure: true,
+  };
+
+  expect(oidc.maskConfiguration()).toEqual({
+    clientid: '[REDACTED]',
+    clientsecret: '[REDACTED]',
+    discovery: 'https://idp/.well-known/openid-configuration',
+    redirect: false,
+    cafile: '[REDACTED]',
+    insecure: true,
+    timeout: 5000,
+  });
+});
+
 test('getStrategyDescription should return strategy description', async () => {
   oidc.logoutUrl = 'https://idp/logout';
   expect(oidc.getStrategyDescription()).toEqual({
@@ -1147,6 +1210,7 @@ test('initAuthentication should discover and configure client', async () => {
 
   const callArgs = openidClientMock.discovery.mock.calls[0];
   expect(callArgs[4].execute).toEqual([]);
+  expect(callArgs[4][openidClientMock.customFetch]).toBeUndefined();
   expect(oidc.logoutUrl).toBe('https://idp/logout');
 });
 
@@ -1212,6 +1276,74 @@ test('initAuthentication should handle non-Error end session url failure', async
   );
 });
 
+test('initAuthentication should configure custom fetch when cafile is set', async () => {
+  const { caPath, cleanup } = await createTemporaryCaFile();
+  const fetchSpy = vi
+    .spyOn(globalThis, 'fetch')
+    .mockResolvedValue(new Response(null, { status: 200 }) as Response);
+  oidc.configuration = {
+    ...configurationValid,
+    cafile: caPath,
+  };
+  const mockClient = {};
+  openidClientMock.discovery = vi.fn().mockResolvedValue(mockClient);
+  openidClientMock.buildEndSessionUrl = vi.fn().mockReturnValue(new URL('https://idp/logout'));
+
+  try {
+    await oidc.initAuthentication();
+
+    const callArgs = openidClientMock.discovery.mock.calls[0];
+    const customFetch = callArgs[4][openidClientMock.customFetch];
+    expect(typeof customFetch).toBe('function');
+
+    await customFetch('https://idp.example.com/.well-known/openid-configuration', {
+      method: 'GET',
+    });
+    expect(fetchSpy).toHaveBeenCalledWith(
+      'https://idp.example.com/.well-known/openid-configuration',
+      expect.objectContaining({ dispatcher: expect.anything() }),
+    );
+  } finally {
+    fetchSpy.mockRestore();
+    await cleanup();
+  }
+});
+
+test('initAuthentication should configure custom fetch and warn when insecure TLS is enabled', async () => {
+  const fetchSpy = vi
+    .spyOn(globalThis, 'fetch')
+    .mockResolvedValue(new Response(null, { status: 200 }) as Response);
+  oidc.configuration = {
+    ...configurationValid,
+    insecure: true,
+  };
+  const mockClient = {};
+  openidClientMock.discovery = vi.fn().mockResolvedValue(mockClient);
+  openidClientMock.buildEndSessionUrl = vi.fn().mockReturnValue(new URL('https://idp/logout'));
+
+  try {
+    await oidc.initAuthentication();
+
+    expect(oidc.log.warn).toHaveBeenCalledWith(
+      'TLS certificate verification disabled for OIDC - do not use in production',
+    );
+
+    const callArgs = openidClientMock.discovery.mock.calls[0];
+    const customFetch = callArgs[4][openidClientMock.customFetch];
+    expect(typeof customFetch).toBe('function');
+
+    await customFetch('https://idp.example.com/.well-known/openid-configuration', {
+      method: 'GET',
+    });
+    expect(fetchSpy).toHaveBeenCalledWith(
+      'https://idp.example.com/.well-known/openid-configuration',
+      expect.objectContaining({ dispatcher: expect.anything() }),
+    );
+  } finally {
+    fetchSpy.mockRestore();
+  }
+});
+
 test('initAuthentication should use configured logouturl when end session url is unsupported', async () => {
   oidc.configuration = {
     ...configurationValid,
diff --git a/app/authentications/providers/oidc/Oidc.ts b/app/authentications/providers/oidc/Oidc.ts
index 6b704f9c..0846d734 100644
--- a/app/authentications/providers/oidc/Oidc.ts
+++ b/app/authentications/providers/oidc/Oidc.ts
@@ -1,8 +1,12 @@
+import { readFile } from 'node:fs/promises';
+import type { ConnectionOptions } from 'node:tls';
 import type { Request, Response } from 'express';
 import rateLimit from 'express-rate-limit';
 import * as openidClientLibrary from 'openid-client';
+import { Agent } from 'undici';
 import { v4 as uuid } from 'uuid';
 import { ddEnvVars, getPublicUrl, getServerConfiguration } from '../../../configuration/index.js';
+import { resolveConfiguredPath } from '../../../runtime/paths.js';
 import { getErrorMessage } from '../../../util/error.js';
 import { enforceConcurrentSessionLimit } from '../../../util/session-limit.js';
 import Authentication from '../Authentication.js';
@@ -316,6 +320,8 @@ class Oidc extends Authentication {
       discovery: this.joi.string().uri().required(),
       clientid: this.joi.string().required(),
       clientsecret: this.joi.string().required(),
+      cafile: this.joi.string(),
+      insecure: this.joi.boolean().default(false),
       redirect: this.joi.boolean().default(false),
       logouturl: this.joi.string().uri({ scheme: ['http', 'https'] }),
       timeout: this.joi.number().greater(500).default(5000),
@@ -341,6 +347,10 @@ class Oidc extends Authentication {
       discovery: this.configuration.discovery,
       clientid: Oidc.mask(this.configuration.clientid),
       clientsecret: Oidc.mask(this.configuration.clientsecret),
+      ...(this.configuration.cafile ? { cafile: Oidc.mask(this.configuration.cafile) } : {}),
+      ...(typeof this.configuration.insecure === 'boolean'
+        ? { insecure: this.configuration.insecure }
+        : {}),
       redirect: this.configuration.redirect,
       ...(this.configuration.logouturl ? { logouturl: this.configuration.logouturl } : {}),
       timeout: this.configuration.timeout,
@@ -359,15 +369,39 @@ class Oidc extends Authentication {
       );
       execute = [openidClient.allowInsecureRequests];
     }
+    const discoveryOptions: openidClientLibrary.DiscoveryRequestOptions = {
+      timeout: timeoutSeconds,
+      execute,
+    };
+    if (this.configuration.cafile || this.configuration.insecure) {
+      const connectOptions: ConnectionOptions = {};
+      if (this.configuration.cafile) {
+        const caFilePath = resolveConfiguredPath(this.configuration.cafile, {
+          label: 'OIDC CA certificate path',
+        });
+        connectOptions.ca = await readFile(caFilePath);
+      }
+      if (this.configuration.insecure) {
+        this.log.warn('TLS certificate verification disabled for OIDC - do not use in production');
+        connectOptions.rejectUnauthorized = false;
+      }
+      const dispatcher = new Agent({ connect: connectOptions });
+      const oidcFetch: openidClientLibrary.CustomFetch = (input, init) =>
+        fetch(
+          input as RequestInfo | URL,
+          {
+            ...(init as unknown as RequestInit),
+            dispatcher,
+          } as RequestInit & { dispatcher: Agent },
+        );
+      discoveryOptions[openidClient.customFetch] = oidcFetch;
+    }
     this.client = await openidClient.discovery(
       discoveryUrl,
       this.configuration.clientid,
       this.configuration.clientsecret,
       openidClient.ClientSecretPost(this.configuration.clientsecret),
-      {
-        timeout: timeoutSeconds,
-        execute,
-      },
+      discoveryOptions,
     );
     this.logoutUrl = this.configuration.logouturl;
     try {
diff --git a/app/package-lock.json b/app/package-lock.json
index 696e4a51..f54f4485 100644
--- a/app/package-lock.json
+++ b/app/package-lock.json
@@ -51,6 +51,7 @@
         "semver": "7.7.4",
         "set-value": "4.1.0",
         "sort-es": "1.7.18",
+        "undici": "^7.22.0",
         "uuid": "^13.0.0",
         "yaml": "2.8.2"
       },
@@ -7437,6 +7438,15 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/undici": {
+      "version": "7.22.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.22.0.tgz",
+      "integrity": "sha512-RqslV2Us5BrllB+JeiZnK4peryVTndy9Dnqq62S3yYRRTj0tFQCwEniUy2167skdGOy3vqRzEvl1Dm4sV2ReDg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=20.18.1"
+      }
+    },
     "node_modules/undici-types": {
       "version": "7.18.2",
       "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.18.2.tgz",
diff --git a/app/package.json b/app/package.json
index 252d06aa..c54c5d8f 100644
--- a/app/package.json
+++ b/app/package.json
@@ -62,6 +62,7 @@
     "semver": "7.7.4",
     "set-value": "4.1.0",
     "sort-es": "1.7.18",
+    "undici": "^7.22.0",
     "uuid": "^13.0.0",
     "yaml": "2.8.2"
   },

From 6849fb14e5a47205bb5ae88f8ef7e65436029134 Mon Sep 17 00:00:00 2001
From: superuserjr <80784472+turbodaemon@users.noreply.github.com>
Date: Tue, 10 Mar 2026 10:18:53 -0400
Subject: [PATCH 28/34] =?UTF-8?q?=F0=9F=93=9D=20docs:=20add=20OIDC=20TLS?=
 =?UTF-8?q?=20and=20MQTT=20filter=20configuration=20docs?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Document CAFILE/INSECURE options for OIDC auth and HASS_FILTER_INCLUDE/
HASS_FILTER_EXCLUDE options for MQTT trigger with precedence order and
examples.
---
 .../authentications/oidc/index.mdx            |  6 +++
 .../configuration/triggers/mqtt/index.mdx     | 44 ++++++++++++++-----
 2 files changed, 39 insertions(+), 11 deletions(-)

diff --git a/content/docs/current/configuration/authentications/oidc/index.mdx b/content/docs/current/configuration/authentications/oidc/index.mdx
index 0d94f690..e8d0d11c 100644
--- a/content/docs/current/configuration/authentications/oidc/index.mdx
+++ b/content/docs/current/configuration/authentications/oidc/index.mdx
@@ -17,6 +17,8 @@ The `oidc` authentication lets you protect drydock access using the [Openid Conn
 | `DD_AUTH_OIDC_{auth_name}_CLIENTID` | 🔴 | Client ID | | |
 | `DD_AUTH_OIDC_{auth_name}_CLIENTSECRET` | 🔴 | Client Secret | | |
 | `DD_AUTH_OIDC_{auth_name}_DISCOVERY` | 🔴 | Oidc discovery URL | | |
+| `DD_AUTH_OIDC_{auth_name}_CAFILE` | ⚪ | Path to a PEM CA certificate (or chain) used for OIDC HTTPS requests | File path | empty |
+| `DD_AUTH_OIDC_{auth_name}_INSECURE` | ⚪ | Disable TLS certificate verification for OIDC HTTPS requests (development only) | `true`, `false` | `false` |
 | `DD_AUTH_OIDC_{auth_name}_REDIRECT` | ⚪ | Skip internal login page & automatically redirect to the OIDC provider | `true`, `false` | `false` |
 | `DD_AUTH_OIDC_{auth_name}_LOGOUTURL` | ⚪ | Explicit IdP logout URL fallback when discovery metadata has no `end_session_endpoint` | URL | empty |
 | `DD_AUTH_OIDC_{auth_name}_TIMEOUT` | ⚪ | Timeout (in ms) when calling the OIDC provider | Minimum is 500 | `5000` |
@@ -30,6 +32,10 @@ The `oidc` authentication lets you protect drydock access using the [Openid Conn
 
 <Callout type="warn">`http://` OIDC discovery URLs are deprecated and will be removed in v1.6.0. When the discovery URL uses `http:`, drydock passes `allowInsecureRequests` to the OIDC client. Migrate your IdP to HTTPS before upgrading.</Callout>
 
+<Callout type="info">If your provider uses a private/self-signed CA, the quickest container-level workaround is `NODE_EXTRA_CA_CERTS=/path/to/ca.pem`. Drydock now also supports OIDC-scoped TLS settings with `DD_AUTH_OIDC_{auth_name}_CAFILE` and `DD_AUTH_OIDC_{auth_name}_INSECURE`.</Callout>
+
+<Callout type="warn">`DD_AUTH_OIDC_{auth_name}_INSECURE=true` disables TLS certificate verification for OIDC HTTPS calls (discovery, token, userinfo, JWKS). Use only for local/dev troubleshooting.</Callout>
+
 <Callout type="info">**Redirect URL validation** — Drydock validates all OIDC authorization redirect URLs against an allowlist derived from the configured callback URL origin. This prevents open redirect attacks through crafted callback parameters. No configuration is needed — validation is enforced automatically.</Callout>
 
 <Callout type="info">**OIDC logout URL resolution** — drydock first tries the provider discovery `end_session_endpoint`. If it is missing, you can set `DD_AUTH_OIDC_{auth_name}_LOGOUTURL` when your provider (or proxy) exposes a logout URL outside discovery metadata. If neither is available, `POST /auth/logout` only destroys the local drydock session.</Callout>
diff --git a/content/docs/current/configuration/triggers/mqtt/index.mdx b/content/docs/current/configuration/triggers/mqtt/index.mdx
index 18492480..af37f6c3 100644
--- a/content/docs/current/configuration/triggers/mqtt/index.mdx
+++ b/content/docs/current/configuration/triggers/mqtt/index.mdx
@@ -23,7 +23,9 @@ The `mqtt` trigger lets you send container update notifications to an MQTT broke
 | `DD_TRIGGER_MQTT_{trigger_name}_HASS_DISCOVERY` | ⚪ | Enable [Home-assistant](https://www.home-assistant.io/) integration including discovery | `true`, `false` | `false` |
 | `DD_TRIGGER_MQTT_{trigger_name}_HASS_PREFIX` | ⚪ | Base topic for hass entity discovery | | `homeassistant` |
 | `DD_TRIGGER_MQTT_{trigger_name}_HASS_ATTRIBUTES` | ⚪ | Attribute preset controlling which container fields are included in MQTT payloads. `full` sends everything; `short` excludes large fields like SBOM documents, scan vulnerabilities, details, and labels. | `full`, `short` | `full` |
-| `DD_TRIGGER_MQTT_{trigger_name}_EXCLUDE` | ⚪ | Comma-separated dot-paths to exclude from the MQTT payload. Overrides the `HASS_ATTRIBUTES` preset when set. For example `security.sbom.documents,labels` removes those nested fields before publishing. | Comma-separated dot-paths | |
+| `DD_TRIGGER_MQTT_{trigger_name}_HASS_FILTER_INCLUDE` | ⚪ | Comma-separated list of flattened MQTT attribute keys to keep (include-mode). When set, only these keys are published. | Comma-separated flattened keys | |
+| `DD_TRIGGER_MQTT_{trigger_name}_HASS_FILTER_EXCLUDE` | ⚪ | Comma-separated list of flattened MQTT attribute keys to remove (exclude-mode). Used when `HASS_FILTER_INCLUDE` is empty. | Comma-separated flattened keys | |
+| `DD_TRIGGER_MQTT_{trigger_name}_EXCLUDE` | ⚪ | Legacy comma-separated dot-paths to exclude from the nested container object before flattening. Used only when both `HASS_FILTER_INCLUDE` and `HASS_FILTER_EXCLUDE` are empty. | Comma-separated dot-paths | |
 | `DD_TRIGGER_MQTT_{trigger_name}_TLS_CACHAIN` | ⚪ | The path to the file containing the server CA chain (when TLS with a private Certificate Authority) | Any valid file path | |
 | `DD_TRIGGER_MQTT_{trigger_name}_TLS_CLIENTCERT` | ⚪ | The path to the file containing the client public certificate (when TLS mutual authentication) | Any valid file path | |
 | `DD_TRIGGER_MQTT_{trigger_name}_TLS_CLIENTKEY` | ⚪ | The path to the file containing the client private key (when TLS mutual authentication) | Any valid file path | |
@@ -215,22 +217,42 @@ Entities expose all the details of the container as attributes:
 
 Container MQTT payloads can include large nested fields (SBOM documents, scan vulnerability arrays, environment details, labels) that exceed Home Assistant's `json_attributes_topic` size limits or clutter entity attributes.
 
-Two layers of filtering are available:
+Filtering is applied in this precedence order:
 
-### Layer 1: Attribute preset (`HASS_ATTRIBUTES`)
+1. `HASS_FILTER_INCLUDE` (flattened key include list)
+2. `HASS_FILTER_EXCLUDE` (flattened key exclude list)
+3. `EXCLUDE` (legacy nested dot-path exclude list)
+4. `HASS_ATTRIBUTES` preset fallback
 
-| Preset | Behavior |
-| --- | --- |
-| `full` (default) | Sends the entire container object — no filtering |
-| `short` | Excludes `security.sbom.documents`, `security.updateSbom.documents`, `security.scan.vulnerabilities`, `security.updateScan.vulnerabilities`, `details`, and `labels` |
+### Include mode (`HASS_FILTER_INCLUDE`)
+
+Set `DD_TRIGGER_MQTT_{trigger_name}_HASS_FILTER_INCLUDE` to keep only selected flattened keys.
+
+```yaml
+environment:
+  - DD_TRIGGER_MQTT_MOSQUITTO_HASS_FILTER_INCLUDE=name,image_name,update_available,result_tag
+```
 
-### Layer 2: Explicit exclude paths (`EXCLUDE`)
+### Exclude mode (`HASS_FILTER_EXCLUDE`)
 
-Set `DD_TRIGGER_MQTT_{trigger_name}_EXCLUDE` to a comma-separated list of dot-paths to remove from the payload. When `EXCLUDE` is set, it overrides the preset entirely.
+Set `DD_TRIGGER_MQTT_{trigger_name}_HASS_FILTER_EXCLUDE` to remove selected flattened keys.
 
 ```yaml
 environment:
-  - DD_TRIGGER_MQTT_MOSQUITTO_EXCLUDE=security.sbom.documents,security.scan.vulnerabilities,labels
+  - DD_TRIGGER_MQTT_MOSQUITTO_HASS_FILTER_EXCLUDE=security_sbom_documents_0_spdx_version,security_scan_vulnerabilities_0_id
 ```
 
-<Callout type="info">Filtering clones only the path ancestors needed for deletion — unrelated fields keep their original references with no deep-clone overhead. When no filtering is configured, the original container object is passed through with zero overhead.</Callout>
+### Legacy nested exclude (`EXCLUDE`)
+
+`DD_TRIGGER_MQTT_{trigger_name}_EXCLUDE` still supports comma-separated nested dot-paths (for example `security.sbom.documents,labels`). This legacy filter is only used when `HASS_FILTER_INCLUDE` and `HASS_FILTER_EXCLUDE` are both empty.
+
+### Attribute preset fallback (`HASS_ATTRIBUTES`)
+
+When no explicit include/exclude list is configured, `HASS_ATTRIBUTES` is used:
+
+| Preset | Behavior |
+| --- | --- |
+| `full` (default) | Sends the entire container object — no filtering |
+| `short` | Excludes `security.sbom.documents`, `security.updateSbom.documents`, `security.scan.vulnerabilities`, `security.updateScan.vulnerabilities`, `details`, and `labels` |
+
+<Callout type="info">`HASS_FILTER_INCLUDE` and `HASS_FILTER_EXCLUDE` match flattened MQTT keys (snake_case + underscore delimiter), because filtering is applied after flattening to the payload shape Home Assistant receives.</Callout>

From 4943b9c30535f4370154ae3738cc661664a30a7e Mon Sep 17 00:00:00 2001
From: superuserjr <80784472+turbodaemon@users.noreply.github.com>
Date: Tue, 10 Mar 2026 10:49:54 -0400
Subject: [PATCH 29/34] =?UTF-8?q?=E2=9C=85=20test:=20add=20edge-case=20cov?=
 =?UTF-8?q?erage=20for=20fix=20agents'=20changes?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add tests for MQTT default attributes fallback, filterContainerInclude
symbol key preservation, pruneOldContainers missing watcher key, custom
displayName preservation on name change, and hook env allowlisted
prefixes parameter.
---
 app/runtime/child-process-env.test.ts         | 11 +++++
 app/runtime/child-process-env.ts              |  3 +-
 app/triggers/providers/mqtt/Mqtt.test.ts      | 18 +++++++++
 app/triggers/providers/mqtt/filter.test.ts    | 14 +++++++
 app/watchers/providers/docker/Docker.test.ts  | 26 ++++++++++++
 ...docker-image-details-orchestration.test.ts | 40 +++++++++++++++++++
 6 files changed, 111 insertions(+), 1 deletion(-)

diff --git a/app/runtime/child-process-env.test.ts b/app/runtime/child-process-env.test.ts
index f484af60..942272dd 100644
--- a/app/runtime/child-process-env.test.ts
+++ b/app/runtime/child-process-env.test.ts
@@ -38,4 +38,15 @@ describe('runtime/child-process-env', () => {
       SECRET_TOKEN: 'override-only',
     });
   });
+
+  test('buildHookCommandEnvironment can inherit values from allowlisted prefixes', () => {
+    const parentEnv = {
+      DD_HOOK_CUSTOM: 'custom-value',
+      SECRET_TOKEN: 'should-not-leak',
+    };
+
+    expect(buildHookCommandEnvironment({}, parentEnv, ['DD_HOOK_'])).toEqual({
+      DD_HOOK_CUSTOM: 'custom-value',
+    });
+  });
 });
diff --git a/app/runtime/child-process-env.ts b/app/runtime/child-process-env.ts
index d67636db..86e5e060 100644
--- a/app/runtime/child-process-env.ts
+++ b/app/runtime/child-process-env.ts
@@ -43,9 +43,10 @@ function buildAllowlistedEnvironment(
 export function buildHookCommandEnvironment(
   overrides: Record<string, string> = {},
   parentEnv: NodeJS.ProcessEnv = process.env,
+  allowlistedPrefixes: readonly string[] = [],
 ): ChildProcessEnv {
   return {
-    ...buildAllowlistedEnvironment(parentEnv, BASE_ALLOWLISTED_ENV_KEYS),
+    ...buildAllowlistedEnvironment(parentEnv, BASE_ALLOWLISTED_ENV_KEYS, allowlistedPrefixes),
     ...overrides,
   };
 }
diff --git a/app/triggers/providers/mqtt/Mqtt.test.ts b/app/triggers/providers/mqtt/Mqtt.test.ts
index 7eb5e800..fbf20f30 100644
--- a/app/triggers/providers/mqtt/Mqtt.test.ts
+++ b/app/triggers/providers/mqtt/Mqtt.test.ts
@@ -600,4 +600,22 @@ describe('trigger filtering', () => {
     expect(publishedPayload).toHaveProperty('details_ports_0', '80/tcp');
     expect(publishedPayload).toHaveProperty('labels_com_docker_compose_project', 'app');
   });
+
+  test('should default hass.attributes to full when not provided in runtime config', async () => {
+    mqtt.configuration = {
+      topic: 'dd/container',
+      exclude: '',
+      hass: {
+        filter: {
+          include: '',
+          exclude: '',
+        },
+      },
+    };
+    await mqtt.trigger(containerWithSecurity);
+
+    const publishedPayload = JSON.parse(mqtt.client.publish.mock.calls[0][1]);
+    expect(publishedPayload).toHaveProperty('security_scan_vulnerabilities_0_id', 'CVE-2024-0001');
+    expect(publishedPayload).toHaveProperty('details_ports_0', '80/tcp');
+  });
 });
diff --git a/app/triggers/providers/mqtt/filter.test.ts b/app/triggers/providers/mqtt/filter.test.ts
index 5c8dffbc..365fc41f 100644
--- a/app/triggers/providers/mqtt/filter.test.ts
+++ b/app/triggers/providers/mqtt/filter.test.ts
@@ -224,6 +224,20 @@ describe('filterContainerInclude', () => {
     filterContainerInclude(flattenedContainer, ['name']);
     expect(flattenedContainer).toEqual(original);
   });
+
+  test('preserves symbol keys while filtering string keys', () => {
+    const secret = Symbol('secret');
+    const flattenedWithSymbol = {
+      ...flattenedContainer,
+      [secret]: 'value',
+    };
+
+    const result = filterContainerInclude(flattenedWithSymbol, ['name']);
+    expect(result).toEqual({
+      name: 'test',
+      [secret]: 'value',
+    });
+  });
 });
 
 describe('HASS_ATTRIBUTE_PRESETS', () => {
diff --git a/app/watchers/providers/docker/Docker.test.ts b/app/watchers/providers/docker/Docker.test.ts
index 22e96592..55d4f274 100644
--- a/app/watchers/providers/docker/Docker.test.ts
+++ b/app/watchers/providers/docker/Docker.test.ts
@@ -5553,6 +5553,32 @@ describe('Docker Watcher', () => {
       expect(dockerApi.getContainer).not.toHaveBeenCalled();
       expect(storeContainer.deleteContainer).toHaveBeenCalledWith('old-1');
     });
+
+    test('pruneOldContainers should treat missing watcher as an empty watcher key', async () => {
+      const dockerApi = {
+        getContainer: vi.fn(),
+      };
+
+      await testable_pruneOldContainers(
+        [
+          {
+            id: 'new-1',
+            name: 'app',
+          },
+        ] as any,
+        [
+          {
+            id: 'old-1',
+            watcher: '',
+            name: 'app',
+          },
+        ] as any,
+        dockerApi as any,
+      );
+
+      expect(dockerApi.getContainer).not.toHaveBeenCalled();
+      expect(storeContainer.deleteContainer).toHaveBeenCalledWith('old-1');
+    });
   });
 
   describe('Additional Coverage - maintenance queue internals', () => {
diff --git a/app/watchers/providers/docker/docker-image-details-orchestration.test.ts b/app/watchers/providers/docker/docker-image-details-orchestration.test.ts
index 595eaee9..c0622abf 100644
--- a/app/watchers/providers/docker/docker-image-details-orchestration.test.ts
+++ b/app/watchers/providers/docker/docker-image-details-orchestration.test.ts
@@ -282,6 +282,46 @@ describe('docker image details orchestration module', () => {
     expect(containerInStore.displayName).toBe('service');
   });
 
+  test('keeps custom displayName when container name changes', async () => {
+    const containerInStore = {
+      id: 'container-1',
+      name: 'temp-name-123',
+      displayName: 'Friendly Service',
+      status: 'running',
+      error: undefined,
+      details: {
+        ports: [],
+        volumes: [],
+        env: [],
+      },
+      image: {
+        name: 'acme/service',
+        id: 'image-old',
+        digest: {
+          repo: 'sha256:old',
+          value: 'sha256:old',
+        },
+        created: '2025-01-01T00:00:00.000Z',
+      },
+    };
+    vi.spyOn(storeContainer, 'getContainer').mockReturnValue(containerInStore as any);
+
+    const { watcher } = createWatcher({
+      configuration: { watchevents: true },
+    });
+
+    const result = await addImageDetailsToContainerOrchestration(
+      watcher as any,
+      createDockerSummaryContainer({ Names: ['/service'] }),
+      {},
+      createHelpers() as any,
+    );
+
+    expect(result).toBe(containerInStore);
+    expect(containerInStore.name).toBe('service');
+    expect(containerInStore.displayName).toBe('Friendly Service');
+  });
+
   test('throws a clear error when image inspection fails for a new container', async () => {
     vi.spyOn(storeContainer, 'getContainer').mockReturnValue(undefined);
 

From 173b4184991e1cedaf73e15e3e7f58807bd75794 Mon Sep 17 00:00:00 2001
From: superuserjr <80784472+turbodaemon@users.noreply.github.com>
Date: Tue, 10 Mar 2026 10:50:03 -0400
Subject: [PATCH 30/34] =?UTF-8?q?=F0=9F=94=A7=20chore:=20remove=20snyk=20f?=
 =?UTF-8?q?rom=20lefthook=20pre-push=20pipeline?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Snyk deps and code scans consume the 200/month org quota on every push.
Move to CI-only (release workflow) where they gate the actual release.
---
 lefthook.yml | 20 +++-----------------
 1 file changed, 3 insertions(+), 17 deletions(-)

diff --git a/lefthook.yml b/lefthook.yml
index 773ad551..107e1ae8 100644
--- a/lefthook.yml
+++ b/lefthook.yml
@@ -4,7 +4,9 @@
 # Pre-push pipeline (piped = sequential, fail-fast):
 #   1. Lint gate (~20s) — catches formatting/lint before burning CPU
 #   2. Build + test (~26s parallel) — independent workspaces run concurrently
-#   3. E2E + security (advisory)
+#   3. E2E + advisory scans (zizmor)
+#
+# Snyk scans are CI-only (release workflow) to preserve the 200/month quota.
 #
 # Biome runs directly (not via qlty) because qlty's biome integration
 # does not reliably apply fixes. Qlty handles all other linters.
@@ -52,19 +54,3 @@ pre-push:
       skip:
         - run: '! command -v zizmor >/dev/null 2>&1'
       priority: 6
-
-    # ── Local security gates (skip if tool missing or feature branch) ─
-    # Snyk has a 200 scan/month limit — only run on release/main pushes.
-    snyk-deps:
-      root: app/
-      run: ../scripts/snyk-deps-gate.sh --org=codeswhat
-      skip:
-        - run: '! command -v snyk >/dev/null 2>&1'
-        - run: 'git rev-parse --abbrev-ref HEAD | grep -qvE "^(main|release/)"'
-      priority: 7
-    snyk-code:
-      run: scripts/snyk-code-gate.sh --org=codeswhat
-      skip:
-        - run: '! command -v snyk >/dev/null 2>&1'
-        - run: 'git rev-parse --abbrev-ref HEAD | grep -qvE "^(main|release/)"'
-      priority: 8

From 637bbc916d2b4efe6b298c54009d17ee6f315fdf Mon Sep 17 00:00:00 2001
From: superuserjr <80784472+turbodaemon@users.noreply.github.com>
Date: Tue, 10 Mar 2026 11:43:57 -0400
Subject: [PATCH 31/34] =?UTF-8?q?=F0=9F=94=A7=20chore(qa):=20add=20Mosquit?=
 =?UTF-8?q?to=20broker=20and=20icon=20test=20labels=20to=20QA=20env?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Add eclipse-mosquitto:2 service with anonymous access for MQTT E2E testing
- Configure DD_TRIGGER_MQTT_QA with HASS mode and FILTER_INCLUDE
- Add dd.display.icon labels: si:si:nginx (nested), si:redis (colon), si-traefikproxy (dash)
- Drydock depends_on mosquitto healthcheck before starting
---
 test/mosquitto.conf |  2 ++
 test/qa-compose.yml | 30 ++++++++++++++++++++++++++++++
 2 files changed, 32 insertions(+)
 create mode 100644 test/mosquitto.conf

diff --git a/test/mosquitto.conf b/test/mosquitto.conf
new file mode 100644
index 00000000..c8348ac4
--- /dev/null
+++ b/test/mosquitto.conf
@@ -0,0 +1,2 @@
+listener 1883
+allow_anonymous true
diff --git a/test/qa-compose.yml b/test/qa-compose.yml
index 8ef19c7f..e0b605e8 100644
--- a/test/qa-compose.yml
+++ b/test/qa-compose.yml
@@ -39,6 +39,13 @@ services:
       - DD_TRIGGER_SMTP_MYEMAIL_PASS=fakesmtppassword
       - DD_TRIGGER_SMTP_MYEMAIL_FROM=alerts@example.com
       - DD_TRIGGER_SMTP_MYEMAIL_TO=admin@example.com
+      # --- MQTT trigger (Home Assistant mode with filtering) ---
+      - DD_TRIGGER_MQTT_QA_URL=mqtt://mosquitto:1883
+      - DD_TRIGGER_MQTT_QA_HASS_ENABLED=true
+      - DD_TRIGGER_MQTT_QA_HASS_PREFIX=homeassistant
+      - DD_TRIGGER_MQTT_QA_HASS_DISCOVERY=true
+      - DD_TRIGGER_MQTT_QA_HASS_ATTRIBUTES=short
+      - DD_TRIGGER_MQTT_QA_HASS_FILTER_INCLUDE=name,image_name,result_tag,update_kind_kind
       # --- Docker Compose trigger (manual only) ---
       - DD_TRIGGER_DOCKERCOMPOSE_QA_FILE=/drydock/qa-compose.yml
       - DD_TRIGGER_DOCKERCOMPOSE_QA_AUTO=false
@@ -70,6 +77,8 @@ services:
     depends_on:
       docker-remote:
         condition: service_healthy
+      mosquitto:
+        condition: service_healthy
 
   # ── OIDC Identity Provider (Dex) ─────────────────────
   dex:
@@ -81,6 +90,21 @@ services:
       - ./dex-config.yaml:/etc/dex/config.yaml:ro
     command: ["dex", "serve", "/etc/dex/config.yaml"]
 
+  # ── MQTT broker (Mosquitto) ──────────────────────────
+  mosquitto:
+    image: eclipse-mosquitto:2
+    container_name: mosquitto
+    ports:
+      - "1883:1883"
+    volumes:
+      - ./mosquitto.conf:/mosquitto/config/mosquitto.conf:ro
+    healthcheck:
+      test: ["CMD-SHELL", "mosquitto_sub -t '$$SYS/#' -C 1 -W 3 || exit 1"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+      start_period: 5s
+
   # ── Trivy vulnerability scanner (client-server mode) ──
   trivy-server:
     image: aquasec/trivy:latest
@@ -123,6 +147,7 @@ services:
   # ── Containers with updates available ──────────────────
 
   # Nginx with lifecycle hooks (tests hooks UI + group view)
+  # Icon uses colon separator with nested prefix (tests Fix 03 + Fix 06)
   nginx-hooked:
     image: nginx:1.25.5
     pull_policy: never
@@ -130,12 +155,14 @@ services:
     labels:
       - dd.watch=true
       - dd.display.name=Nginx (Hooked)
+      - dd.display.icon=si:si:nginx
       - dd.group=web-stack
       - dd.hook.pre=echo "pre-update check"
       - dd.hook.post=echo "post-update cleanup"
       - dd.hook.timeout=30000
 
   # Redis in same group (tests group view)
+  # Icon uses colon separator (tests Fix 06)
   redis-cache:
     image: redis:7.2.0
     pull_policy: never
@@ -143,9 +170,11 @@ services:
     labels:
       - dd.watch=true
       - dd.display.name=Redis Cache
+      - dd.display.icon=si:redis
       - dd.group=web-stack
 
   # Traefik with auto-rollback (tests rollback UI)
+  # Icon uses dash separator (standard format — baseline comparison)
   traefik-proxy:
     image: traefik:v3.0.0
     pull_policy: never
@@ -153,6 +182,7 @@ services:
     labels:
       - dd.watch=true
       - dd.display.name=Traefik Proxy
+      - dd.display.icon=si-traefikproxy
       - dd.group=infra
       - dd.rollback.auto=true
       - dd.rollback.window=120000

From ac7c134312eac77d79c8b2a3391da9cbaf0616a4 Mon Sep 17 00:00:00 2001
From: superuserjr <80784472+turbodaemon@users.noreply.github.com>
Date: Tue, 10 Mar 2026 13:25:23 -0400
Subject: [PATCH 32/34] =?UTF-8?q?=F0=9F=90=9B=20fix(ui):=20wire=20bouncer-?=
 =?UTF-8?q?blocked=20state=20into=20container=20detail=20views?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Detail views (full-page, side panel, tab content) were missing bouncer
awareness — clicking Update on a security-blocked container silently
failed with a 500 error. Now blocked containers show a red "Blocked"
button with lock icon that opens the force-update confirmation dialog.
Also adds an error banner to full-page detail for action failures.
---
 .../containers/ContainerFullPageDetail.vue    | 26 ++++++++++++++++++-
 .../ContainerFullPageTabContent.vue           | 11 +++++++-
 .../containers/ContainerSideDetail.vue        | 13 +++++++++-
 .../containers/ContainerSideTabContent.vue    | 11 +++++++-
 4 files changed, 57 insertions(+), 4 deletions(-)

diff --git a/ui/src/components/containers/ContainerFullPageDetail.vue b/ui/src/components/containers/ContainerFullPageDetail.vue
index f1f7b637..3f572513 100644
--- a/ui/src/components/containers/ContainerFullPageDetail.vue
+++ b/ui/src/components/containers/ContainerFullPageDetail.vue
@@ -10,8 +10,10 @@ const {
   confirmRestart,
   scanContainer,
   confirmUpdate,
+  confirmForceUpdate,
   confirmDelete,
   actionInProgress,
+  error,
   registryColorBg,
   registryColorText,
   registryLabel,
@@ -132,7 +134,18 @@ const {
             Scan
           </button>
           <button
-            v-if="selectedContainer.newTag"
+            v-if="selectedContainer.newTag && selectedContainer.bouncer === 'blocked'"
+            class="flex items-center gap-1.5 px-3 py-1.5 dd-rounded text-[11px] font-bold transition-colors"
+            :class="actionInProgress === selectedContainer.name ? 'opacity-50 cursor-not-allowed' : ''"
+            :style="{ backgroundColor: 'var(--dd-danger-muted)', color: 'var(--dd-danger)', border: '1px solid var(--dd-danger)' }"
+            :disabled="actionInProgress === selectedContainer.name"
+            aria-label="Update blocked by security scan"
+            @click="confirmForceUpdate(selectedContainer.name)">
+            <AppIcon name="lock" :size="12" />
+            Blocked
+          </button>
+          <button
+            v-else-if="selectedContainer.newTag"
             class="flex items-center gap-1.5 px-3 py-1.5 dd-rounded text-[11px] font-bold transition-colors"
             :class="actionInProgress === selectedContainer.name ? 'opacity-50 cursor-not-allowed' : ''"
             :style="{ backgroundColor: 'var(--dd-success-muted)', color: 'var(--dd-success)', border: '1px solid var(--dd-success)' }"
@@ -171,6 +184,17 @@ const {
       </div>
     </div>
 
+    <div
+      v-if="error"
+      class="shrink-0 mb-4 px-4 py-3 dd-rounded-lg flex items-center gap-3 text-[12px] font-medium"
+      :style="{ backgroundColor: 'var(--dd-danger-muted)', color: 'var(--dd-danger)', border: '1px solid var(--dd-danger)' }">
+      <AppIcon name="warning" :size="14" class="shrink-0" />
+      <span class="min-w-0 break-words">{{ error }}</span>
+      <button class="ml-auto shrink-0 hover:opacity-70 transition-opacity" aria-label="Dismiss error" @click="error = null">
+        <AppIcon name="x" :size="12" />
+      </button>
+    </div>
+
     <ContainerFullPageTabContent />
   </div>
 </template>
diff --git a/ui/src/components/containers/ContainerFullPageTabContent.vue b/ui/src/components/containers/ContainerFullPageTabContent.vue
index c5ddf4b9..2cc8e501 100644
--- a/ui/src/components/containers/ContainerFullPageTabContent.vue
+++ b/ui/src/components/containers/ContainerFullPageTabContent.vue
@@ -127,6 +127,7 @@ const {
   updateOperationsError,
   scanContainer,
   confirmUpdate,
+  confirmForceUpdate,
   registryColorBg,
   registryColorText,
   registryLabel,
@@ -679,7 +680,15 @@ const {
                             @click="runContainerPreview">
                       {{ previewLoading ? 'Previewing...' : 'Preview Update' }}
                     </button>
-                    <button class="px-3 py-1.5 dd-rounded text-[11px] font-semibold transition-colors dd-text-muted hover:dd-text hover:dd-bg-elevated"
+                    <button v-if="selectedContainer.bouncer === 'blocked'"
+                            class="px-3 py-1.5 dd-rounded text-[11px] font-semibold transition-colors"
+                            :style="{ backgroundColor: 'var(--dd-danger-muted)', color: 'var(--dd-danger)', border: '1px solid var(--dd-danger)' }"
+                            :disabled="actionInProgress === selectedContainer.name"
+                            @click="confirmForceUpdate(selectedContainer.name)">
+                      <AppIcon name="lock" :size="10" class="mr-1 inline" />Force Update
+                    </button>
+                    <button v-else
+                            class="px-3 py-1.5 dd-rounded text-[11px] font-semibold transition-colors dd-text-muted hover:dd-text hover:dd-bg-elevated"
                             :style="{ border: '1px solid var(--dd-border-strong)' }"
                             :disabled="!selectedContainer.newTag || actionInProgress === selectedContainer.name"
                             @click="confirmUpdate(selectedContainer.name)">
diff --git a/ui/src/components/containers/ContainerSideDetail.vue b/ui/src/components/containers/ContainerSideDetail.vue
index 866c3dbc..4226393c 100644
--- a/ui/src/components/containers/ContainerSideDetail.vue
+++ b/ui/src/components/containers/ContainerSideDetail.vue
@@ -17,6 +17,7 @@ const {
   confirmRestart,
   scanContainer,
   confirmUpdate,
+  confirmForceUpdate,
   confirmDelete,
   tt,
 } = useContainersViewTemplateContext();
@@ -71,7 +72,17 @@ const {
             <AppIcon name="security" :size="12" />
           </button>
           <button
-            v-if="selectedContainer.newTag"
+            v-if="selectedContainer.newTag && selectedContainer.bouncer === 'blocked'"
+            class="w-7 h-7 dd-rounded flex items-center justify-center transition-[color,background-color,border-color,opacity,transform,box-shadow]"
+            :class="actionInProgress === selectedContainer.name ? 'dd-text-muted opacity-50 cursor-not-allowed' : 'hover:dd-bg-hover hover:scale-110 active:scale-95'"
+            :style="{ color: 'var(--dd-danger)' }"
+            :disabled="actionInProgress === selectedContainer.name"
+            v-tooltip.top="tt('Blocked — Force Update')"
+            @click="confirmForceUpdate(selectedContainer.name)">
+            <AppIcon name="lock" :size="12" />
+          </button>
+          <button
+            v-else-if="selectedContainer.newTag"
             class="w-7 h-7 dd-rounded flex items-center justify-center transition-[color,background-color,border-color,opacity,transform,box-shadow]"
             :class="actionInProgress === selectedContainer.name ? 'dd-text-muted opacity-50 cursor-not-allowed' : 'dd-text-muted hover:dd-text-success hover:dd-bg-hover hover:scale-110 active:scale-95'"
             :disabled="actionInProgress === selectedContainer.name"
diff --git a/ui/src/components/containers/ContainerSideTabContent.vue b/ui/src/components/containers/ContainerSideTabContent.vue
index 81868378..88b7cf4f 100644
--- a/ui/src/components/containers/ContainerSideTabContent.vue
+++ b/ui/src/components/containers/ContainerSideTabContent.vue
@@ -130,6 +130,7 @@ const {
   updateOperationsError,
   scanContainer,
   confirmUpdate,
+  confirmForceUpdate,
   registryColorBg,
   registryColorText,
   registryLabel,
@@ -623,7 +624,15 @@ const {
                           @click="runContainerPreview">
                     {{ previewLoading ? 'Previewing...' : 'Preview Update' }}
                   </button>
-                  <button class="px-2.5 py-1.5 dd-rounded text-[10px] font-semibold transition-colors dd-text-muted hover:dd-text hover:dd-bg-elevated"
+                  <button v-if="selectedContainer.bouncer === 'blocked'"
+                          class="px-2.5 py-1.5 dd-rounded text-[10px] font-semibold transition-colors"
+                          :style="{ backgroundColor: 'var(--dd-danger-muted)', color: 'var(--dd-danger)', border: '1px solid var(--dd-danger)' }"
+                          :disabled="actionInProgress === selectedContainer.name"
+                          @click="confirmForceUpdate(selectedContainer.name)">
+                    <AppIcon name="lock" :size="10" class="mr-1 inline" />Force Update
+                  </button>
+                  <button v-else
+                          class="px-2.5 py-1.5 dd-rounded text-[10px] font-semibold transition-colors dd-text-muted hover:dd-text hover:dd-bg-elevated"
                           :style="{ border: '1px solid var(--dd-border-strong)' }"
                           :disabled="!selectedContainer.newTag || actionInProgress === selectedContainer.name"
                           @click="confirmUpdate(selectedContainer.name)">

From 4d3f3c886ca096cc677b1e79fa149eecc40eda4a Mon Sep 17 00:00:00 2001
From: superuserjr <80784472+turbodaemon@users.noreply.github.com>
Date: Tue, 10 Mar 2026 13:25:33 -0400
Subject: [PATCH 33/34] =?UTF-8?q?=F0=9F=94=A7=20chore(qa):=20disable=20cos?=
 =?UTF-8?q?ign=20signature=20verification=20in=20QA=20env?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Allows update flow testing without requiring signed images.
---
 test/qa-compose.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/qa-compose.yml b/test/qa-compose.yml
index e0b605e8..4666af9c 100644
--- a/test/qa-compose.yml
+++ b/test/qa-compose.yml
@@ -63,7 +63,7 @@ services:
       - DD_SECURITY_BLOCK_SEVERITY=CRITICAL
       - DD_SECURITY_SBOM_ENABLED=true
       - DD_SECURITY_SBOM_FORMATS=spdx-json,cyclonedx-json
-      - DD_SECURITY_VERIFY_SIGNATURES=true
+      - DD_SECURITY_VERIFY_SIGNATURES=false
       # --- Maintenance window (QA) ---
       # Uncomment to test; adjust cron to match/not-match current time
       # - DD_WATCHER_LOCAL_MAINTENANCE_WINDOW=0 2-6 * * *

From d0135ed65ebe20f0c18a5fc7e88b7c2caa1d3fd8 Mon Sep 17 00:00:00 2001
From: superuserjr <80784472+turbodaemon@users.noreply.github.com>
Date: Tue, 10 Mar 2026 14:44:37 -0400
Subject: [PATCH 34/34] =?UTF-8?q?=F0=9F=94=A7=20chore:=20add=20clean-tree?=
 =?UTF-8?q?=20gate=20to=20pre-push=20pipeline?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rejects pushes when the working tree has untracked files, uncommitted
changes, or stashed changes. Runs at priority 0 before all other checks.

Prevents qlty from hanging on interactive "Format these files?" prompts
when untracked files are present, and catches the common case where
local tests pass against uncommitted changes that CI will never see.
---
 lefthook.yml | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/lefthook.yml b/lefthook.yml
index 107e1ae8..57ac61c4 100644
--- a/lefthook.yml
+++ b/lefthook.yml
@@ -2,6 +2,7 @@
 # Lefthook configuration — mirrors CI pipeline for local/CI parity.
 #
 # Pre-push pipeline (piped = sequential, fail-fast):
+#   0. Clean tree gate — rejects untracked/uncommitted/stashed files
 #   1. Lint gate (~20s) — catches formatting/lint before burning CPU
 #   2. Build + test (~26s parallel) — independent workspaces run concurrently
 #   3. E2E + advisory scans (zizmor)
@@ -26,6 +27,32 @@ pre-commit:
 pre-push:
   piped: true
   commands:
+    # ── Clean tree gate: fail if working tree is dirty ─────────────────
+    # Catches untracked files (which hang qlty on interactive prompts),
+    # uncommitted changes (which pass locally but fail CI), and stashed
+    # changes (which hide work that should be committed or discarded).
+    clean-tree:
+      run: |
+        dirty=$(git status --porcelain 2>/dev/null)
+        stash=$(git stash list 2>/dev/null)
+        fail=0
+        if [ -n "$dirty" ]; then
+          echo "❌ Working tree is not clean:"
+          echo "$dirty"
+          echo ""
+          echo "Commit, stash, or remove these files before pushing."
+          fail=1
+        fi
+        if [ -n "$stash" ]; then
+          echo "⚠️  Stash is not empty:"
+          echo "$stash"
+          echo ""
+          echo "Apply or drop stashed changes — they won't be in CI."
+          fail=1
+        fi
+        exit $fail
+      priority: 0
+
     # ── Lint gate: fast checks that catch formatting/lint issues ──────
     ts-nocheck:
       run: node scripts/check-ts-nocheck-allowlist.mjs