Merge branch 'redenfire:main' into main

Author: NeoMod

README.md

@@ -15,7 +15,6 @@ If you want stable/default deployment, keep using upstream image `ghcr.io/redenf
 docker run -d \
   --name image-watch \
   -v /var/run/docker.sock:/var/run/docker.sock \
-  -v image-watch-data:/data \
   -p 8099:8080 \
   ghcr.io/redenfire/docker-image-watcher:latest
 ```
@@ -35,27 +34,22 @@ services:
       - "8099:8080"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
-      - image-watch-data:/data
     environment:
       - PORT=8080
       - DOCKER_SOCK=/var/run/docker.sock
-      - AUTO_FILE=/data/auto-update.json
       # - CHECK_INTERVAL=10m      # default: 10m
       # - CHECK_CONCURRENCY=5     # default: 5
       # - AUTO_COOLDOWN=5m        # default: 5m
       # - AUTH_USER=admin         # uncomment to enable auth
       # - AUTH_PASS=changeme
-
-volumes:
-  image-watch-data:
 ```
 
 ## Features
 
 - Lists running containers grouped by image, with per-container status
 - Supports OCI-compatible registries including Docker Hub, GHCR, Quay, and self-hosted registries
 - One-click update per container or "Update all" per image group, with live progress bars
-- Per-container auto-update toggle persisted to disk
+- Per-container auto-update via Docker label `image-watch.auto-update`
 - Background check every 10 minutes with 5-minute auto-update cooldown
 - i18n with EN/IT language toggle
 - Optional auth via AUTH_USER/AUTH_PASS with login page and HMAC-signed session cookies
@@ -120,7 +114,6 @@ Full reference: [`docs/project/API.md`](docs/project/API.md)
 |---|---|---|
 | `PORT` | `8080` | HTTP listen port |
 | `DOCKER_SOCK` | `/var/run/docker.sock` | Docker Unix socket path |
-| `AUTO_FILE` | `/data/auto-update.json` | Persisted auto-update state file |
 | `AUTH_USER` | — | Enable HTTP auth (required together with AUTH_PASS) |
 | `AUTH_PASS` | — | Password for HTTP auth |
 | `CHECK_INTERVAL` | `10m` | Background check interval |

docker-compose.yml

@@ -7,17 +7,12 @@ services:
       - "8099:8080"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
-      - image-watch-data:/data
     environment:
       - PORT=8080
       - DOCKER_SOCK=/var/run/docker.sock
-      - AUTO_FILE=/data/auto-update.json
       # - CHECK_INTERVAL=10m      # default: 10m
       # - CHECK_CONCURRENCY=5     # default: 5
       # - AUTO_COOLDOWN=5m        # default: 5m
       # - AUTH_USER=admin         # uncomment to enable auth
       # - AUTH_PASS=changeme
-      # - DOCKER_REGISTRY_AUTH=username:password  # uncomment to avoid Docker Hub unauthenticated pull rate limits
-
-volumes:
-  image-watch-data:
+      # - DOCKER_REGISTRY_AUTH=username:password  # uncomment to avoid Docker Hub unauthenticated pull rate limits

docker.go

@@ -7,6 +7,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"log"
 	"net"
 	"net/http"
 	"net/url"
@@ -18,17 +19,19 @@ import (
 var dockerSocket = "/var/run/docker.sock"
 
 type dockerContainer struct {
-	ID      string   `json:"Id"`
-	Names   []string `json:"Names"`
-	Image   string   `json:"Image"`
-	ImageID string   `json:"ImageID"`
+	ID      string            `json:"Id"`
+	Names   []string          `json:"Names"`
+	Image   string            `json:"Image"`
+	ImageID string            `json:"ImageID"`
+	Labels  map[string]string `json:"Labels"`
 }
 
 type dockerInspect struct {
-	ID         string          `json:"Id"`
-	Name       string          `json:"Name"`
-	Config     json.RawMessage `json:"Config"`
-	HostConfig json.RawMessage `json:"HostConfig"`
+	ID              string          `json:"Id"`
+	Name            string          `json:"Name"`
+	Config          json.RawMessage `json:"Config"`
+	HostConfig      json.RawMessage `json:"HostConfig"`
+	NetworkSettings json.RawMessage `json:"NetworkSettings"`
 }
 
 func dockerClient() *http.Client {
@@ -293,6 +296,30 @@ func getImageDigest(imageID string) (string, error) {
 	return "", fmt.Errorf("no digest found")
 }
 
+func localDigestMatches(imageID, imageTag, remoteDigest string) bool {
+	for _, ref := range []string{imageID, imageTag} {
+		if ref == "" {
+			continue
+		}
+		resp, err := dockerAPI("GET", "/images/"+ref+"/json", nil)
+		if err != nil {
+			continue
+		}
+		var data struct {
+			RepoDigests []string `json:"RepoDigests"`
+		}
+		json.NewDecoder(resp.Body).Decode(&data)
+		resp.Body.Close()
+		for _, d := range data.RepoDigests {
+			_, after, ok := strings.Cut(d, "@")
+			if ok && after == remoteDigest {
+				return true
+			}
+		}
+	}
+	return false
+}
+
 func resolveImageName(imageID string) string {
 	resp, err := dockerAPI("GET", "/images/"+imageID+"/json", nil)
 	if err != nil {
@@ -326,40 +353,31 @@ func recreateContainer(id, image string) error {
 	createBody["Image"] = image
 	delete(createBody, "Hostname")
 
-	type hostCfg struct {
-		Binds         []string               `json:"Binds"`
-		PortBindings  map[string]interface{} `json:"PortBindings"`
-		RestartPolicy map[string]interface{} `json:"RestartPolicy"`
-		NetworkMode   string                 `json:"NetworkMode"`
-		Privileged    bool                   `json:"Privileged"`
-		ExtraHosts    []string               `json:"ExtraHosts"`
-		DNS           []string               `json:"Dns"`
-		CapAdd        []string               `json:"CapAdd"`
-		CapDrop       []string               `json:"CapDrop"`
-		Devices       []interface{}          `json:"Devices"`
-		ShmSize       int64                  `json:"ShmSize"`
-		Sysctls       map[string]string      `json:"Sysctls"`
-		Runtime       string                 `json:"Runtime"`
-		GroupAdd      []string               `json:"GroupAdd"`
-		IpcMode       string                 `json:"IpcMode"`
-		PidMode       string                 `json:"PidMode"`
-		UsernsMode    string                 `json:"UsernsMode"`
-		UTSMode       string                 `json:"UTSMode"`
-	}
-
-	var hc hostCfg
-	if err := json.Unmarshal(inspect.HostConfig, &hc); err != nil {
+	var hostConfig map[string]interface{}
+	if err := json.Unmarshal(inspect.HostConfig, &hostConfig); err != nil {
 		return fmt.Errorf("unmarshal host config: %w", err)
 	}
-	createBody["HostConfig"] = hc
+	createBody["HostConfig"] = hostConfig
 
-	if hc.NetworkMode != "" && hc.NetworkMode != "default" && hc.NetworkMode != "bridge" {
-		netConfig := map[string]interface{}{
-			"EndpointsConfig": map[string]interface{}{
-				hc.NetworkMode: map[string]interface{}{},
-			},
+	if inspect.NetworkSettings != nil {
+		var netSettings struct {
+			Networks map[string]map[string]interface{} `json:"Networks"`
+		}
+		if err := json.Unmarshal(inspect.NetworkSettings, &netSettings); err == nil && len(netSettings.Networks) > 0 {
+			endpoints := make(map[string]interface{}, len(netSettings.Networks))
+			for netName, netData := range netSettings.Networks {
+				ep := map[string]interface{}{}
+				for _, k := range []string{"IPAMConfig", "Aliases", "Links", "DriverOpts"} {
+					if v, ok := netData[k]; ok {
+						ep[k] = v
+					}
+				}
+				endpoints[netName] = ep
+			}
+			createBody["NetworkingConfig"] = map[string]interface{}{
+				"EndpointsConfig": endpoints,
+			}
 		}
-		createBody["NetworkingConfig"] = netConfig
 	}
 
 	body, err := json.Marshal(createBody)
@@ -418,9 +436,22 @@ func recreateContainer(id, image string) error {
 	if err != nil {
 		return fmt.Errorf("start container %s: %w", created.ID, err)
 	}
+	if resp != nil && resp.StatusCode >= 400 {
+		return fmt.Errorf("start container %s: daemon returned %s", created.ID, resp.Status)
+	}
 	return nil
 }
 
+func pruneUnusedImages() {
+	resp, err := dockerAPI("POST", "/images/prune?filters="+url.QueryEscape(`{"dangling":{"true":true}}`), nil)
+	if resp != nil {
+		resp.Body.Close()
+	}
+	if err != nil {
+		log.Printf("prune images: %v", err)
+	}
+}
+
 func init() {
 	if s := os.Getenv("DOCKER_SOCK"); s != "" {
 		dockerSocket = s

docs/project/API.md

@@ -40,7 +40,7 @@ Fields:
 - `container_name`: Docker container name without leading `/`
 - `local_digest`: shortened local digest or `unknown`
 - `status`: `uptodate`, `outdated`, or `unknown`
-- `auto_update`: persisted toggle state for this container
+- `auto_update`: read from Docker label `image-watch.auto-update` on the container
 
 ### `PullProgress`
 
@@ -109,7 +109,7 @@ curl -X POST http://localhost:8099/api/images/3d4c5b6a7f8e/update
 
 ### `POST /api/images/{id}/auto-update`
 
-Toggle auto-update for given container.
+Returns the current auto-update state for the given container, read from the Docker label `image-watch.auto-update`. The endpoint is read-only — enable/disable by setting the label on the container definition.
 
 Success response:
 
@@ -218,7 +218,7 @@ Common errors emitted by handlers:
 | Status | Body | When |
 |---|---|---|
 | `400` | `bad path: /api/images/{id}/{action}\n` | Path after `/api/images/` does not contain exactly `{id}/{action}` |
-| `400` | `unknown action\n` | Action is not `update`, `auto-update`, or `progress` |
+| `400` | `unknown action\n` | Action is not `update`, `auto-update`, or `progress` (`auto-update` is now read-only) |
 | `404` | `container not found\n` | Container ID is not present in current `app.images` snapshot |
 | `404` | `no progress\n` | No active progress snapshot for given container |
 | `405` | `method not allowed\n` | Wrong HTTP method used for endpoint |

docs/project/ARCHITECTURE.md

@@ -70,7 +70,7 @@ Runtime dependencies:
 ### `web/index.html`
 
 - Polls `/api/images` every 10 seconds
-- Shows container table, digest comparison, status badges, progress UI, and auto-update toggles
+- Shows container table, digest comparison, status badges, progress UI, and auto-update indicators (read from Docker labels)
 - Calls API routes (images, groups, auth) directly from browser JavaScript
 
 ## Key Call Chains
@@ -104,14 +104,15 @@ main.go:updateContainer()
 -> main.go:checkAll()
 ```
 
-### Auto-update persistence
+### Auto-update detection
 
 ```text
-main.go:toggleAuto()
--> update app.images
--> update app.autoSaved
--> saveAuto()
--> write AUTO_FILE JSON map
+main.go:checkAll()
+-> docker.go:listContainers()
+   (includes Labels in dockerContainer struct)
+-> for each container:
+   -> read label "image-watch.auto-update"
+   -> set item.AutoUpdate = true if label equals "true"
 ```
 
 ## Route-to-Handler Mapping
@@ -123,7 +124,7 @@ main.go:toggleAuto()
 | `/api/auth/status` | `GET` | inline handler | Returns JSON `{"enabled": true/false}` |
 | `/api/images` | `GET` | `app.handleImages` | Returns JSON array of `ImageGroup` |
 | `/api/images/{id}/update` | `POST` | `app.handleImageAction` | Starts async update goroutine |
-| `/api/images/{id}/auto-update` | `POST` | `app.handleImageAction` | Toggles persisted auto-update flag |
+| `/api/images/{id}/auto-update` | `POST` | `app.handleImageAction` | Returns current auto-update state from Docker label (read-only) |
 | `/api/images/{id}/progress` | `GET` | `app.handleImageAction` | Returns `PullProgress` for in-flight update |
 | `/api/groups/{image}/update` | `POST` | `app.handleGroupAction` | Starts async update for all containers of an image |
 | `/api/login` | `POST` | `handleLogin` | Authenticates user, returns session cookie |
@@ -132,7 +133,7 @@ main.go:toggleAuto()
 
 ## Concurrency Model
 
-- `sync.RWMutex` protects `images`, `autoSaved`, and `cooldowns`
+- `sync.RWMutex` protects `images` and `cooldowns`
 - `sync.Map` stores per-container progress snapshots
 - Manual update runs in goroutine from route handler
 - Periodic checks run in background ticker goroutine

docs/project/AUTO-UPDATE.md

@@ -2,36 +2,31 @@
 
 ## How It Is Enabled
 
-Auto-update can be toggled:
+Auto-update is controlled via the Docker label `image-watch.auto-update` on the container.
 
-- from web UI toggle in `web/index.html`
-- via `POST /api/images/{id}/auto-update`
+To enable, add the label to your container or service:
 
-Toggle state is returned as:
-
-```json
-{"auto_update":true}
+```yaml
+services:
+  my-service:
+    labels:
+      - "image-watch.auto-update=true"
 ```
 
-## Persistence Model
+The label is **declarative**: it survives every recreate (manual or automatic) because `recreateContainer()` copies existing labels from the old container to the new one during `inspect -> stop -> remove -> create -> start`.
 
-State is stored as JSON map in `AUTO_FILE`.
+The web UI displays the current auto-update state (read from the label) but does not allow toggling — the label must be set in the container definition (e.g., `docker-compose.yml`).
 
-Example:
+The `POST /api/images/{id}/auto-update` endpoint still returns the current state, but does not modify it.
 
-```json
-{
-  "3d4c5b6a7f8e": true,
-  "9f8e7d6c5b4a": false
-}
-```
+## Why Labels Instead of a File
 
-Implementation points:
+| Approach | Survives recreate? | Declarative? |
+|---|---|---|
+| `auto-update.json` (previous) | No — new container ID = lost state | No |
+| Docker label `image-watch.auto-update` (current) | Yes — labels are copied on recreate | Yes |
 
-- `App.autoSaved` keeps in-memory map
-- `loadAuto()` reads file on startup
-- `saveAuto()` writes file after each toggle
-- keys use short 12-character container IDs
+This makes auto-update a true lifecycle feature rather than a one-shot toggle.
 
 ## Check Interval
 
@@ -57,13 +52,13 @@ This avoids repeated rapid recreate cycles when a container stays reported as ou
 Auto-update only triggers when all conditions are true:
 
 - container appears in current running container list
-- auto-update is enabled for that container
+- container has label `image-watch.auto-update=true`
 - computed status is `outdated`
 - no active cooldown (default 5 min, configurable via `AUTO_COOLDOWN`) blocks that container
 
 ## Concurrency and State Safety
 
-- `sync.RWMutex` protects `images`, `autoSaved`, and `cooldowns`
+- `sync.RWMutex` protects `images` and `cooldowns`
 - `sync.Map` stores pull progress snapshots
 - route-triggered manual updates run in goroutines
 - cooldown tracking reduces risk of concurrent repeated auto-updates for same container