fix(templates): yaml-based parser + persistent error dialog + UniFi root creds (v8.7.2)

Three related fixes for the template-deploy path:

1) PARSER (latent bug since forever): the Docker-API deploy returned
   "(HTTP code 400) bad parameter - no command specified" for any template
   with a top-level volumes: block — i.e. every template with a named
   volume (postgres, redis, mariadb, mongo, every LSIO image). The hand-
   rolled line parser treated ANY 2-space-indented name: as a service, so
   volumes: -> redis-data: produced a phantom service with empty Image.
   Rewritten to use the yaml package — extracts only doc.services.*,
   ignores volumes/configs/networks. Also now supports map-form
   environment, long-form ports, string|array command, container_name,
   and IP-prefixed ports ("127.0.0.1:2375:2375"). Imageless services
   produce a clear 400 instead of the cryptic generic Docker error.

2) UNIFI TEMPLATE: the v8.6.2 inline configs: content: script for Mongo
   user creation is a Compose-CLI-only feature the API deploy cannot
   apply. Switched to root Mongo credentials (MONGO_INITDB_ROOT_USERNAME
   / PASSWORD + MONGO_AUTHSOURCE=admin) so the stack deploys cleanly via
   the API.

3) PERSISTENT ERROR DIALOG: Toast.error fades in 4s so deploy failures
   were undebuggable. Replaced with a persistent sub-modal showing full
   Docker error + failing service/container + partial deploys + the
   compose YAML sent, with a Copy button. Backend now returns structured
   { error, service, containerName, partial } on failure; api.js attaches
   .body and .status to the thrown Error so the dialog has all of it.

Browser-verified: deploys lsio-prowlarr cleanly (response {ok:true,
containers:[{name:"prowlarr",...}]}, 0 console errors); error modal
renders correctly with full block + Copy. Suite green 1444.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: bogdanpricop

CHANGELOG.md

@@ -2,6 +2,27 @@
 
 All notable changes to Docker Dash are documented here.
 
+## [8.7.2] - 2026-05-27 — Template deploy: parser rewrite + persistent error dialog + UniFi simplified
+
+### Fixed (long-standing latent bug)
+The Docker-API template deploy was returning **"(HTTP code 400) bad parameter - no command specified"** for any template with a top-level `volumes:` (or `configs:` / `networks:`) block — that includes **every template with a named volume** (postgres, redis, mariadb, mongo, every LSIO template, …). The hand-rolled line parser at `_parseComposeServices` treated any 2-space-indented `name:` as a service, so `volumes:\n  redis-data:` produced a phantom "redis-data" service with empty `Image`, which Docker rejected with the cryptic "no command specified".
+
+- **Parser rewritten** to use the project's `yaml` package — now correctly extracts only `doc.services.*`, ignoring `volumes` / `configs` / `networks` top-level blocks. Supports both array and map forms of `environment`, both short-form strings and long-form `{ target, published, protocol }` for ports, both string and array forms of `command`, and `container_name` overrides.
+- **`command:` is honored** in `createOpts.Cmd` (string `command:` runs via `/bin/sh -c`, array form passes through). Templates that relied on a `command:` override (litellm) now actually use it.
+- **IP-prefixed ports** (e.g. `"127.0.0.1:2375:2375"` in `lsio-socket-proxy`) now parsed and bound to the right interface via `HostConfig.PortBindings[…].HostIp`.
+- Imageless services produce a **clear 400** with the offending service name, instead of letting Docker return the cryptic generic error.
+
+### Persistent deploy-error dialog
+Replaces the 4-second `Toast.error` (which made deploy failures essentially undebuggable) with a **persistent sub-modal** showing the full Docker error, the failing service + container, any partial deploys, and the compose YAML that was sent — with a **Copy** button. Closes only when the user clicks Close or the X.
+
+The backend now returns structured `{ error, service, containerName, partial: [...] }` on failure, and `api.js` attaches `.body` and `.status` to the thrown `Error` so the dialog can show all of it.
+
+### UniFi template simplified
+The v8.6.2 UniFi template used Compose `configs:` with `content:` for the inline Mongo init script — a Compose-CLI feature the API-based deploy can't apply. Switched to **root Mongo credentials** (`MONGO_INITDB_ROOT_USERNAME` / `MONGO_INITDB_ROOT_PASSWORD` on mongo + `MONGO_AUTHSOURCE=admin` on the app) so the stack now deploys cleanly via the Docker API without any external file or healthcheck. The first-start race is handled by `restart: unless-stopped` (unifi may crash once before Mongo is ready, then restarts).
+
+### Verified
+End-to-end browser test deploys `lsio-prowlarr` cleanly through the new code path (response: `{ ok: true, containers: [{ name: "prowlarr", ... }] }`, zero console errors); the persistent error modal renders correctly with the full error block + Copy/Close. Suite green (1444), template-tests pass, every template's YAML round-trips through the new parser.
+
 ## [8.7.1] - 2026-05-27 — Templates dialog: search field + intersect filter
 
 With 84 built-in templates now in **Containers → Templates**, scanning the grid for a specific image was painful. Adds a live search field above the category buttons.

docker-compose.yml

@@ -4,8 +4,8 @@ services:
       context: .
       dockerfile: Dockerfile
       args:
-        APP_VERSION: "${APP_VERSION:-8.7.1}"
-    image: docker-dash:${APP_VERSION:-8.7.1}
+        APP_VERSION: "${APP_VERSION:-8.7.2}"
+    image: docker-dash:${APP_VERSION:-8.7.2}
     container_name: docker-dash
     restart: unless-stopped
     env_file:
@@ -54,7 +54,7 @@ services:
   dd-egress-filter:
     build:
       context: ./docker/egress-filter
-    image: docker-dash-egress-filter:${APP_VERSION:-8.7.1}
+    image: docker-dash-egress-filter:${APP_VERSION:-8.7.2}
     container_name: dd-egress-filter
     restart: unless-stopped
     # Uses the default bridge so target containers on the default bridge can

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "docker-dash",
-  "version": "8.7.1",
+  "version": "8.7.2",
   "description": "Full-featured Docker management dashboard",
   "main": "src/server.js",
   "scripts": {

package.json

@@ -74,7 +74,10 @@ const Api = {
         ? await res.json()
         : await res.text();
       if (!res.ok) {
-        throw new Error(data?.error || data?.message || `HTTP ${res.status}`);
+        const err = new Error(data?.error || data?.message || `HTTP ${res.status}`);
+        err.status = res.status;
+        err.body = data;
+        throw err;
       }
       return data;
     } catch (err) {

public/js/api.js

@@ -1848,7 +1848,7 @@ const ContainersPage = {
                   Toast.success(i18n.t('pages.containers.templatesDeplyed', { name: tmpl.name }));
                   await this._loadList();
                 } catch (err) {
-                  Toast.error(i18n.t('pages.containers.templatesDeployFailed', { message: err.message }));
+                  this._showDeployError(tmpl, err, compose);
                 }
               },
               onCancel: () => {
@@ -1905,11 +1905,60 @@ const ContainersPage = {
         Toast.success(i18n.t('pages.containers.templatesDeplyed', { name: tmpl.name }));
         await this._loadList();
       } catch (err) {
-        Toast.error(i18n.t('pages.containers.templatesDeployFailed', { message: err.message }));
+        this._showDeployError(tmpl, err, tmpl.compose);
       }
     }
   },
 
+  /**
+   * Persistent error dialog for template deploy failures. The Docker error
+   * (and any structured fields the backend returned — service name, container
+   * name, partial successes) is shown in a modal the user has to close, with
+   * a Copy button so the message can be pasted into an issue. Replaces the
+   * 4-second Toast.error which made debugging impossible.
+   */
+  _showDeployError(tmpl, err, composeText) {
+    const body = (err && err.body) || {};
+    const message = (err && err.message) || 'Unknown error';
+    const status = (err && err.status) ? ` (HTTP ${err.status})` : '';
+    const detailLines = [];
+    if (body.service) detailLines.push(`service:        ${body.service}`);
+    if (body.containerName) detailLines.push(`container:      ${body.containerName}`);
+    if (Array.isArray(body.partial) && body.partial.length) {
+      detailLines.push(`partial deploy: ${body.partial.length} container(s) created before the failure:`);
+      body.partial.forEach(p => detailLines.push(`  - ${p.name}${p.started === false ? ' (created, NOT started)' : ''}`));
+    }
+    const details = detailLines.length ? detailLines.join('\n') + '\n\n' : '';
+    const errorBlock = `Template:       ${tmpl.id} (${tmpl.name})\nError${status}: ${message}\n\n${details}--- Compose YAML sent ---\n${composeText || tmpl.compose || ''}`;
+
+    const html = `
+      <div class="modal-header">
+        <h3 style="color:var(--red)"><i class="fas fa-circle-exclamation" style="margin-right:8px"></i>Deploy failed — ${Utils.escapeHtml(tmpl.name)}</h3>
+        <button class="modal-close-btn" id="deploy-err-x"><i class="fas fa-times"></i></button>
+      </div>
+      <div class="modal-body">
+        <p class="text-muted text-sm" style="margin-bottom:8px">The Docker API returned an error. The full message is below — copy it before closing if you want to debug or report it.</p>
+        ${body.partial && body.partial.length ? `<div class="empty-msg is-warning" style="margin-bottom:10px"><i class="fas fa-triangle-exclamation"></i><p><strong>Partial deploy:</strong> ${body.partial.length} container(s) were created before the failure. Stop/remove them from the Containers page if you need to start clean.</p></div>` : ''}
+        <pre class="inspect-json" style="max-height:60vh;overflow:auto;white-space:pre-wrap;font-size:12px;border:1px solid var(--red);border-radius:4px;padding:10px">${Utils.escapeHtml(errorBlock)}</pre>
+      </div>
+      <div class="modal-footer">
+        <button class="btn btn-secondary" id="deploy-err-copy"><i class="fas fa-copy"></i> ${i18n.t('common.copy')}</button>
+        <button class="btn btn-primary" id="deploy-err-ok">${i18n.t('common.close')}</button>
+      </div>
+    `;
+
+    // If a modal is already open (e.g. the template configurator), layer this on top via openSub.
+    const useSub = !!(Modal._content && Modal._content.parentElement && getComputedStyle(Modal._content.parentElement).display !== 'none');
+    const opts = { width: 'min(900px, 95vw)' };
+    const root = useSub ? Modal.openSub(html, opts) : (Modal.open(html, opts), Modal._content);
+    const close = () => { if (useSub) Modal.closeSub(); else Modal.close(); };
+    root.querySelector('#deploy-err-x').addEventListener('click', close);
+    root.querySelector('#deploy-err-ok').addEventListener('click', close);
+    root.querySelector('#deploy-err-copy').addEventListener('click', () => {
+      Utils.copyToClipboard(errorBlock).then(() => Toast.success(i18n.t('common.copied')));
+    });
+  },
+
   // ─── Health Check Logs Viewer ──────────────────
 
   _showActionsGuide() {

public/js/pages/containers.js

@@ -9,6 +9,16 @@ const WhatsNewPage = {
   // Add new releases at the TOP of this array.
   // Types: feature, fix, improvement, security, breaking
   _releases: [
+    {
+      version: '8.7.2',
+      date: '2026-05-27',
+      title: 'Template deploy: parser rewrite + persistent error dialog',
+      changes: [
+        { type: 'fix', text: 'Fixed a long-standing latent bug: the Docker-API template deploy returned "no command specified" for every template with a top-level volumes: block (postgres, redis, mariadb, every LSIO template…). The hand-rolled line parser treated any 2-space-indented name: as a service, so volumes: → redis-data: created a phantom service with no image. Rewritten to use the yaml package — extracts only doc.services.*, correctly ignores top-level volumes/configs/networks blocks.' },
+        { type: 'fix', text: 'Deploy errors no longer flash in a toast that disappears in 4 seconds. Failures now open a persistent sub-modal with the full Docker error, the failing service + container name, any partial deploys, the compose YAML that was sent, and a Copy button. Closes only on user action so you can actually read and debug what went wrong.' },
+        { type: 'improvement', text: 'Template deploy now honors command: (string form via /bin/sh -c, array form passed through), container_name: overrides, and IP-prefixed ports like "127.0.0.1:2375:2375" (lsio-socket-proxy). Imageless services produce a clear 400 with the offending service name instead of the cryptic generic Docker error. UniFi template simplified to root Mongo credentials so it deploys cleanly via the API (the prior inline configs script was a Compose-CLI-only feature).' },
+      ],
+    },
     {
       version: '8.7.1',
       date: '2026-05-27',