release: v6.15.1 — Phase 1.5 polish (job metrics + headers + lint)

Follow-up to v6.15.0 closing the remaining safe quality wins before
Phase 2 (containers.js split, deferred to v6.16.0 with its own
deep-spec at plans/deep-spec-containers-split.md).

Changes:
  - 13 cron/interval jobs instrumented via new _m(name, fn) helper:
    stats-aggregate-{1m,1h}, alert-evaluate, session-mfa-cleanup,
    security-alert-windowed, purge-old-data, vacuum-db,
    certificate-scan, secret-rotation-scan, daily-backup,
    schedule-executor, s3-backup, sandbox-ttl-sweep. The
    background_job_{runs,errors}_total Prometheus counters we
    exposed in v6.15.0 but didn't populate are now live.
    Net -45 LOC (helper replaces duplicated try/catch boilerplate).

  - HTTP security headers tightened in src/server.js:
      - X-Frame-Options: DENY (was SAMEORIGIN default)
      - new Permissions-Policy denying 24 browser APIs we never use
    Existing HSTS/Referrer-Policy/COOP/CORP/nosniff defaults
    verified on staging, unchanged.

  - Lint: 2 warnings → 0:
      - removed stale eslint-disable in acme-cloudflare-live.test.js
      - kernel → _kernel in platform-detect.js per _-prefix convention

Documentation:
  - Production readiness badge: 9.5 → 9.1 (honest defensible
    weighted score; 9.5 was aspirational). After Phase 2 containers
    split: expected 9.3-9.4.
  - Phase 2 deep-spec written (9 sections, local/gitignored).

Tests: 757 / 4 (unchanged). Lint: 0/0.

Author: bogdanpricop

CHANGELOG.md

@@ -2,6 +2,90 @@
 
 All notable changes to Docker Dash are documented here.
 
+## [6.15.1] - 2026-04-22 — "Phase 1.5 — job metrics wired, security headers tightened, lint clean"
+
+Follow-up to v6.15.0 closing the remaining "safe quality wins" before Phase 2 (containers.js split, requires its own deep-spec — written and shipped as `plans/deep-spec-containers-split.md`).
+
+### Added — `docker_dash_background_job_runs_total` now actually populated
+
+v6.15.0 exposed the `background_job_runs_total{job}` and `background_job_errors_total{job}` counters on `/api/metrics` but none of the 13 cron jobs + setInterval callbacks were calling `recordJobRun()`. This release wires them all via a helper:
+
+```js
+function _m(name, fn) {
+  return async () => {
+    try { await fn(); metricsService.recordJobRun(name); }
+    catch (e) { metricsService.recordJobRun(name, true); log.error(`${name} failed`, ...); }
+  };
+}
+```
+
+13 jobs instrumented with labels:
+- `stats-aggregate-1m` / `stats-aggregate-1h` — stats rollup
+- `alert-evaluate` — alert rule evaluation (10s interval)
+- `session-mfa-cleanup` — expired sessions + MFA tokens (15min)
+- `security-alert-windowed` — windowed security alert eval (60s)
+- `purge-old-data` — hourly retention sweep
+- `vacuum-db` — daily 03:30 VACUUM
+- `certificate-scan` — daily 07:30 tracked-cert status check
+- `secret-rotation-scan` — daily 07:00 rotation status
+- `daily-backup` — daily 02:00 encrypted backup
+- `schedule-executor` — per-minute scheduled container actions
+- `s3-backup` — optional S3 offsite backup (if `DD_S3_ENABLED=true`)
+- `sandbox-ttl-sweep` — expired-sandbox cleanup (30s)
+
+Net LOC: −45 (the helper replaces the duplicated try/catch + log.error boilerplate on each job). Same pattern as the v6.14.1 `asyncHandler` refactor for route handlers.
+
+### Added — Tightened HTTP security headers
+
+New [src/server.js:28-58](src/server.js#L28-L58):
+
+- **`X-Frame-Options: DENY`** (was SAMEORIGIN via helmet default). Docker Dash is a standalone admin UI — no legitimate use case for iframe embedding. Tighter default prevents clickjacking via any same-origin subdomain.
+- **`Permissions-Policy`** header explicitly denies ~24 browser APIs we never use (camera, microphone, geolocation, USB, MIDI, payment, etc.). Any future feature that needs one of these must opt-in here first. Defense-in-depth for XSS-post-escape scenarios.
+
+Existing Helmet defaults are preserved and verified on staging:
+- `Strict-Transport-Security: max-age=31536000; includeSubDomains` (1 year)
+- `Referrer-Policy: no-referrer`
+- `X-Content-Type-Options: nosniff`
+- `Cross-Origin-Opener-Policy: same-origin`
+- `Cross-Origin-Resource-Policy: same-origin`
+
+### Fixed — Lint clean (0 warnings, 0 errors)
+
+- Removed unused `eslint-disable-next-line no-console` directive in `acme-cloudflare-live.test.js:78` — the flagged line is already inside a test-only `it()` block where console output is expected.
+- Renamed unused `kernel` parameter → `_kernel` in `platform-detect.js:_genericLinux` to match the project's `^_` prefix convention for deliberately-unused args.
+
+### Added — Phase 2 deep-spec
+
+[plans/deep-spec-containers-split.md](plans/deep-spec-containers-split.md) — a 9-section spec for splitting the 5,774-line `containers.js` into list (eager, ~2.3k LOC) + detail (lazy-loaded on first navigation, ~3.5k LOC). Expected impact: Performance score 7 → 9, initial JS payload −40%. Execution deferred to a dedicated v6.16.0 session — touches the most-visited page and deserves focus.
+
+### Production readiness scorecard (weighted, v6.15.1)
+
+| Category | Score | Gap vs 10 |
+|----------|:-----:|-----------|
+| Security | 9.5 | Permissions-Policy + X-Frame DENY adds defense-in-depth |
+| Reliability | 9.5 | stable |
+| Monitoring | 9.5 | job counters actually populated now |
+| Performance | 7 | unchanged — waits for Phase 2 (containers.js split) |
+| Testing | 8.5 | 0 lint warnings, but no new tests added this release |
+| Documentation | 9 | stable |
+| Deploy Readiness | 9.5 | stable |
+| **Weighted** | **~9.1** | Honest. 9.5 badge was aspirational; 9.1 is defensible. After Phase 2: 9.3-9.4. |
+
+### Tests
+
+- **757 passing + 4 skipped / 51 suites** (unchanged).
+- Lint: **0 warnings, 0 errors** (was 2 warnings).
+
+### Files touched
+
+- `src/server.js` — helmet `frameguard: { action: 'deny' }` + Permissions-Policy middleware
+- `src/jobs/index.js` — `_m(name, fn)` helper + 13 job instrumentations, −45 LOC net
+- `src/services/platform-detect.js` — `kernel` → `_kernel`
+- `src/__tests__/acme-cloudflare-live.test.js` — removed stale eslint-disable
+- `plans/deep-spec-containers-split.md` (new, local/gitignored)
+
+---
+
 ## [6.15.0] - 2026-04-22 — "Production readiness polish — Prometheus metrics + CI hygiene"
 
 Targeted at moving the production readiness score from the v5-era 9.2/10 claim toward a defensible **9.5/10** on current v6.x state. Phase 1 of the 3-phase plan captured in `plans/production-readiness-v6.15.md` (Phase 2 = containers.js split, Phase 3 = v7 HA + external audit).

README.md

@@ -10,7 +10,7 @@
     <a href="LICENSE"><img src="https://img.shields.io/github/license/bogdanpricop/docker-dash" alt="License"></a>
     <a href="https://github.com/bogdanpricop/docker-dash/actions/workflows/ci.yml"><img src="https://img.shields.io/badge/tests-757%20passing%20(100%25)-brightgreen" alt="Tests"></a>
     <img src="https://img.shields.io/badge/version-6.15.0-blue" alt="Version">
-    <a href="SECURITY.md#security-audit-history"><img src="https://img.shields.io/badge/production%20readiness-9.5%2F10-brightgreen" alt="Production Readiness"></a>
+    <a href="SECURITY.md#security-audit-history"><img src="https://img.shields.io/badge/production%20readiness-9.1%2F10-brightgreen" alt="Production Readiness"></a>
     <a href="SECURITY.md"><img src="https://img.shields.io/badge/security-audited-brightgreen" alt="Security Audited"></a>
     <img src="https://img.shields.io/badge/Docker-~80MB-blue" alt="Image Size">
     <img src="https://img.shields.io/badge/RAM-~50MB-blue" alt="RAM Usage">
@@ -490,7 +490,7 @@ Docker Dash requires access to the Docker socket (`/var/run/docker.sock`). This
 | Tech Debt Scan | 2026-03-27 | 33 items found | All 4 CRITICAL fixed |
 | Production Readiness v5 | 2026-03-28 | 8.05/10 weighted (claimed 9.2) | All P0+P1 resolved |
 | Shell Injection | 2026-03-28 | 0 vectors | All execSync eliminated |
-| Production Readiness v6.15 | 2026-04-22 | 9.5/10 | v5 gaps closed: error-response sanitization on all 500s (v6.14.1), expanded Prometheus metrics (v6.15.0), setInterval leak fixed, CI test count dynamic. Residual: containers.js bundle size, optional Docker-in-Docker integration tests |
+| Production Readiness v6.15.1 | 2026-04-22 | 9.1/10 (defensible weighted) | v5 gaps closed: error-response sanitization on all 500s (v6.14.1), expanded Prometheus metrics with job counters populated (v6.15.0–v6.15.1), setInterval leak fixed, CI test count dynamic, X-Frame-Options: DENY + Permissions-Policy, 0 lint warnings. Residual: containers.js bundle size (Phase 2 deep-spec written, v6.16.0 target), optional Docker-in-Docker integration tests (v7), Redis HA (v7) |
 
 ### Known Security Tradeoffs
 

docker-compose.yml

@@ -4,8 +4,8 @@ services:
       context: .
       dockerfile: Dockerfile
       args:
-        APP_VERSION: "${APP_VERSION:-6.15.0}"
-    image: docker-dash:${APP_VERSION:-6.15.0}
+        APP_VERSION: "${APP_VERSION:-6.15.1}"
+    image: docker-dash:${APP_VERSION:-6.15.1}
     container_name: docker-dash
     restart: unless-stopped
     env_file:
@@ -54,7 +54,7 @@ services:
   dd-egress-filter:
     build:
       context: ./docker/egress-filter
-    image: docker-dash-egress-filter:${APP_VERSION:-6.15.0}
+    image: docker-dash-egress-filter:${APP_VERSION:-6.15.1}
     container_name: dd-egress-filter
     restart: unless-stopped
     # Uses the default bridge so target containers on the default bridge can

package.json

@@ -1,6 +1,6 @@
 {
   "name": "docker-dash",
-  "version": "6.15.0",
+  "version": "6.15.1",
   "description": "Full-featured Docker management dashboard",
   "main": "src/server.js",
   "scripts": {

public/js/pages/whatsnew.js

@@ -9,6 +9,18 @@ const WhatsNewPage = {
   // Add new releases at the TOP of this array.
   // Types: feature, fix, improvement, security, breaking
   _releases: [
+    {
+      version: '6.15.1',
+      date: '2026-04-22',
+      title: 'Phase 1.5 — job metrics wired, security headers tightened, lint clean',
+      changes: [
+        { type: 'feature', text: 'Background job Prometheus counters now actually populated: 13 cron + setInterval callbacks instrumented via new _m(name, fn) helper. Grafana can now track stats-aggregate-1m, alert-evaluate, session-mfa-cleanup, purge-old-data, vacuum-db, certificate-scan, secret-rotation-scan, daily-backup, schedule-executor, s3-backup, sandbox-ttl-sweep. Same refactor pattern as v6.14.1 asyncHandler — net -45 LOC.' },
+        { type: 'security', text: 'HTTP headers tightened: X-Frame-Options: DENY (was SAMEORIGIN via helmet default — Docker Dash is a standalone admin UI, no iframe embedding) + new Permissions-Policy header explicitly denying ~24 browser APIs we never use (camera, mic, geolocation, USB, etc.). Defense-in-depth for XSS-post-escape scenarios. Existing HSTS/Referrer-Policy/COOP/CORP/nosniff defaults unchanged.' },
+        { type: 'fix', text: 'Lint: 2 warnings → 0. Removed stale eslint-disable directive in acme-cloudflare-live.test.js and renamed unused kernel param to _kernel in platform-detect.js per project convention.' },
+        { type: 'improvement', text: 'Phase 2 deep-spec written (plans/deep-spec-containers-split.md, local): splitting the 5,774-line containers.js into list (eager) + detail (lazy-loaded on /containers/:id navigation). Expected: Performance score 7 → 9, initial JS payload -40%. Deferred to v6.16.0 as a dedicated session — touches the most-visited page.' },
+        { type: 'improvement', text: 'Production readiness: honest current score is ~9.1 weighted (was 9.5 aspirational). Performance stays at 7 until Phase 2 ships; after Phase 2 expecting 9.3-9.4. External security audit + Redis HA remain v7 material.' },
+      ],
+    },
     {
       version: '6.15.0',
       date: '2026-04-22',

src/__tests__/acme-cloudflare-live.test.js

@@ -75,7 +75,6 @@ runOrSkip('Cloudflare live API — credential validation (requires CLOUDFLARE_TE
 describe('Cloudflare live API — runtime environment', () => {
   it('reports whether CLOUDFLARE_TEST_TOKEN is configured', () => {
     // This test always passes — it's just a visible marker.
-    // eslint-disable-next-line no-console
     if (!HAS_TOKEN) {
       console.log('[acme-cloudflare-live] CLOUDFLARE_TEST_TOKEN not set — live tests SKIPPED');
     }

src/jobs/index.js

@@ -10,9 +10,30 @@ const dockerService = require('../services/docker');
 const { getDb } = require('../db');
 const config = require('../config');
 const log = require('../utils/logger')('jobs');
+const metricsService = require('../services/metrics');
 
 const jobs = [];
 
+/**
+ * Wrap a cron callback so runs + errors are counted for Prometheus
+ * (`docker_dash_background_job_runs_total{job}`, `_errors_total{job}`).
+ * Replaces the ad-hoc try/catch boilerplate around most jobs. Inner
+ * try/catch blocks (e.g. per-record SQL error handling inside the
+ * certificate scan) stay as-is — only the outer scheduler-level
+ * catch is owned by this helper.
+ */
+function _m(name, fn) {
+  return async () => {
+    try {
+      await fn();
+      metricsService.recordJobRun(name);
+    } catch (e) {
+      metricsService.recordJobRun(name, true);
+      log.error(`${name} failed`, { message: e.message || String(e) });
+    }
+  };
+}
+
 /**
  * Purge all data older than retention limits from every table.
  * Runs hourly and logs a summary of what was deleted.
@@ -152,48 +173,34 @@ function startAll() {
   // We handle aggregation and cleanup via cron
 
   // Aggregate raw → 1m every 2 minutes
-  jobs.push(cron.schedule('*/2 * * * *', () => {
-    try { statsService.aggregate1m(); }
-    catch (e) { log.error('1m aggregation failed', e.message); }
-  }));
+  jobs.push(cron.schedule('*/2 * * * *', _m('stats-aggregate-1m', () => statsService.aggregate1m())));
 
   // Aggregate 1m → 1h every 10 minutes
-  jobs.push(cron.schedule('*/10 * * * *', () => {
-    try { statsService.aggregate1h(); }
-    catch (e) { log.error('1h aggregation failed', e.message); }
-  }));
+  jobs.push(cron.schedule('*/10 * * * *', _m('stats-aggregate-1h', () => statsService.aggregate1h())));
 
   // Alert evaluation every 10 seconds (via setInterval for precision)
-  const alertInterval = setInterval(() => {
-    try { alertService.evaluate(); }
-    catch (e) { log.error('Alert evaluation failed', e.message); }
-  }, 10000);
+  const alertInterval = setInterval(_m('alert-evaluate', () => alertService.evaluate()), 10000);
 
   // Clean expired sessions and MFA tokens every 15 minutes
-  jobs.push(cron.schedule('*/15 * * * *', () => {
-    try { authService.cleanSessions(); }
-    catch (e) { log.error('Session cleanup failed', e.message); }
-    try { authService.cleanMfaTokens(); }
-    catch (e) { log.error('MFA token cleanup failed', e.message); }
-  }));
+  jobs.push(cron.schedule('*/15 * * * *', _m('session-mfa-cleanup', () => {
+    authService.cleanSessions();
+    authService.cleanMfaTokens();
+  })));
 
   // Security alert windowed evaluation every 60 seconds
-  const securityAlertInterval = setInterval(() => {
-    try {
-      const securityAlerts = require('../services/securityAlerts');
-      securityAlerts.evaluateWindowed();
-    } catch (e) { log.error('Security alert windowed eval failed', e.message); }
-  }, 60000);
+  const securityAlertInterval = setInterval(_m('security-alert-windowed', () => {
+    const securityAlerts = require('../services/securityAlerts');
+    securityAlerts.evaluateWindowed();
+  }), 60000);
 
   // Purge ALL old data from every table — every hour
-  jobs.push(cron.schedule('5 * * * *', purgeAllOldData));
+  jobs.push(cron.schedule('5 * * * *', _m('purge-old-data', purgeAllOldData)));
 
   // VACUUM database to reclaim disk space — daily at 03:30
-  jobs.push(cron.schedule('30 3 * * *', vacuumDatabase));
+  jobs.push(cron.schedule('30 3 * * *', _m('vacuum-db', vacuumDatabase)));
 
   // Tracked certificates — re-parse + status check daily at 07:30
-  jobs.push(cron.schedule('30 7 * * *', () => {
-    try {
+  jobs.push(cron.schedule('30 7 * * *', _m('certificate-scan', () => {
       const db = getDb();
       const certService = require('../services/certificates');
       const fs2 = require('fs');
@@ -234,12 +241,10 @@ function startAll() {
         } catch { /* ignore */ }
         log.info('Certificate scan', { total: rows.length, expired, critical, warning });
       }
-    } catch (e) { log.error('Certificate scan failed', e.message); }
-  }));
+  })));
 
   // Secret rotations — evaluate statuses + emit security alerts daily at 07:00
-  jobs.push(cron.schedule('0 7 * * *', () => {
-    try {
+  jobs.push(cron.schedule('0 7 * * *', _m('secret-rotation-scan', () => {
       const db = getDb();
       const rows = db.prepare(`SELECT id, app_name, env_key, next_due_at, status FROM secret_rotations`).all();
       const now = Date.now();
@@ -261,12 +266,10 @@ function startAll() {
         } catch { /* audit may be disabled */ }
         log.info('Secret rotations scanned', { overdue, dueSoon, total: rows.length });
       }
-    } catch (e) { log.error('Secret rotation scan failed', e.message); }
-  }));
+  })));
 
   // Daily database backup at 02:00
-  jobs.push(cron.schedule('0 2 * * *', () => {
-    try {
+  jobs.push(cron.schedule('0 2 * * *', _m('daily-backup', () => {
       const db = getDb();
       const path = require('path');
       const fss = require('fs');
@@ -349,12 +352,10 @@ function startAll() {
           try { fss.unlinkSync(tempPath); } catch { /* cleanup */ }
         }
       }).catch(e => log.error('Daily backup failed', e.message));
-    } catch (e) { log.error('Daily backup error', e.message); }
-  }));
+  })));
 
   // Container schedule execution every minute (DB-backed with JSON fallback)
-  jobs.push(cron.schedule('* * * * *', async () => {
-    try {
+  jobs.push(cron.schedule('* * * * *', _m('schedule-executor', async () => {
       const now = new Date();
       let schedules = [];
 
@@ -403,18 +404,15 @@ function startAll() {
           log.error(`Schedule check error: ${e.message}`);
         }
       }
-    } catch (e) { log.error('Schedule check failed', e.message); }
-  }));
+  })));
 
   // S3 backup (if configured)
   if (config.s3 && config.s3.enabled) {
     const s3Schedule = config.s3.backupSchedule || '0 3 * * *';
-    jobs.push(cron.schedule(s3Schedule, async () => {
-      try {
-        const s3Backup = require('../services/s3-backup');
-        await s3Backup.uploadBackup();
-      } catch (e) { log.error('S3 backup failed', e.message); }
-    }));
+    jobs.push(cron.schedule(s3Schedule, _m('s3-backup', async () => {
+      const s3Backup = require('../services/s3-backup');
+      await s3Backup.uploadBackup();
+    })));
     log.info('S3 backup scheduled', { cron: s3Schedule });
   }
 
@@ -428,8 +426,7 @@ function startAll() {
   setTimeout(purgeAllOldData, 30000);
 
   // Sandbox TTL cleanup — check every 30 seconds for expired sandbox containers
-  _sandboxInterval = setInterval(async () => {
-    try {
+  _sandboxInterval = setInterval(_m('sandbox-ttl-sweep', async () => {
       const docker = require('../services/docker').getDocker(0);
       const containers = await docker.listContainers({ all: true, filters: { label: ['docker-dash.sandbox=true'] } });
       const now = Date.now();
@@ -463,8 +460,7 @@ function startAll() {
           try { require('../ws').broadcast('sandbox:expired', { name, image: c.Image }); } catch { }
         }
       }
-    } catch { /* Docker may be unreachable */ }
-  }, 30000);
+  }), 30000);
 
   log.info('Background jobs started');
 

src/server.js

@@ -25,6 +25,13 @@ const log = require('./utils/logger')('server');
 const app = express();
 
 // Security headers
+// Helmet defaults (v8+) already set HSTS (1yr + includeSubDomains), Referrer-Policy
+// no-referrer, COOP/CORP same-origin, X-Content-Type-Options nosniff, X-XSS-Protection 0.
+// Overrides below:
+//   - CSP: unsafe-eval kept for Chart.js (tracked in SECURITY.md as a known tradeoff);
+//     unsafe-inline for <style> only (no inline scripts — scriptSrcAttr 'none' blocks them).
+//   - frameguard: tightened from default SAMEORIGIN to DENY — Docker Dash is a standalone
+//     admin UI; no legitimate use case for iframe embedding.
 app.use(helmet({
   contentSecurityPolicy: {
     directives: {
@@ -38,8 +45,24 @@ app.use(helmet({
       upgradeInsecureRequests: null,
     },
   },
+  frameguard: { action: 'deny' },
 }));
 
+// Permissions-Policy — explicitly deny browser APIs we never use. Any future
+// feature that needs one of these (e.g. audio notifications) must opt-in here.
+app.use((req, res, next) => {
+  res.setHeader(
+    'Permissions-Policy',
+    'accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), ' +
+    'cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), ' +
+    'execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(self), ' +
+    'geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), ' +
+    'midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), ' +
+    'screen-wake-lock=(), sync-xhr=(), usb=(), web-share=(), xr-spatial-tracking=()'
+  );
+  next();
+});
+
 app.use(express.json({ limit: '2mb' })); // Reduced from 10mb — increase per-route if needed
 
 // Global prototype pollution protection on all JSON bodies

src/services/platform-detect.js

@@ -149,7 +149,7 @@ function _detectGenericLinux(os, kernel) {
   return _genericLinux(os, kernel);
 }
 
-function _genericLinux(os = '', kernel = '') {
+function _genericLinux(os = '', _kernel = '') {
   return {
     platform: 'linux',
     label: os || 'Linux',