Merge branch 'hotfix/1.14.2'

chore(version): bump version number
fix(tls): fix an issue with TLSConfig ignored when using LDAP StartTLS
2017-09-21 17:22:08 +02:00 · 2017-09-21 17:22:01 +02:00 · 2017-09-21 17:19:43 +02:00 · 2017-09-20 15:41:06 +02:00 · 2017-09-20 15:41:01 +02:00 · 2017-09-20 14:38:16 +02:00
369 changed files with 21183 additions and 7427 deletions
@@ -0,0 +1,29 @@
+---
+engines:
+  gofmt:
+    enabled: true
+  golint:
+    enabled: true
+  govet:
+    enabled: true
+  csslint:
+    enabled: true
+  duplication:
+    enabled: true
+    config:
+      languages:
+        javascript:
+          mass_threshold: 80
+  eslint:
+    enabled: true
+    config:
+      config: .eslintrc.yml
+  fixme:
+    enabled: true
+ratings:
+  paths:
+  - "**.css"
+  - "**.js"
+  - "**.go"
+exclude_paths:
+- test/
@@ -1,2 +1,3 @@
 *
 !dist
+!build
@@ -0,0 +1,284 @@
+env:
+  browser: true
+  jquery: true
+
+# globals:
+#   angular: true
+#   $: true
+#   _: true
+#   moment: true
+#   filesize: true
+#   splitargs: true
+extends:
+  - 'eslint:recommended'
+
+# http://eslint.org/docs/rules/
+rules:
+  # Possible Errors
+  no-await-in-loop: off
+  no-cond-assign: error
+  no-console: off
+  no-constant-condition: error
+  no-control-regex: error
+  no-debugger: error
+  no-dupe-args: error
+  no-dupe-keys: error
+  no-duplicate-case: error
+  no-empty-character-class: error
+  no-empty: error
+  no-ex-assign: error
+  no-extra-boolean-cast: error
+  no-extra-parens: off
+  no-extra-semi: error
+  no-func-assign: error
+  no-inner-declarations:
+    - error
+    - functions
+  no-invalid-regexp: error
+  no-irregular-whitespace: error
+  no-negated-in-lhs: error
+  no-obj-calls: error
+  no-prototype-builtins: off
+  no-regex-spaces: error
+  no-sparse-arrays: error
+  no-template-curly-in-string: off
+  no-unexpected-multiline: error
+  no-unreachable: error
+  no-unsafe-finally: off
+  no-unsafe-negation: off
+  use-isnan: error
+  valid-jsdoc: off
+  valid-typeof: error
+
+  # Best Practices
+  accessor-pairs: error
+  array-callback-return: off
+  block-scoped-var: off
+  class-methods-use-this: off
+  complexity:
+    - error
+    - 6
+  consistent-return: off
+  curly: off
+  default-case: off
+  dot-location: off
+  dot-notation: off
+  eqeqeq: error
+  guard-for-in: error
+  no-alert: error
+  no-caller: error
+  no-case-declarations: error
+  no-div-regex: error
+  no-else-return: off
+  no-empty-function: off
+  no-empty-pattern: error
+  no-eq-null: error
+  no-eval: error
+  no-extend-native: error
+  no-extra-bind: error
+  no-extra-label: off
+  no-fallthrough: error
+  no-floating-decimal: off
+  no-global-assign: off
+  no-implicit-coercion: off
+  no-implied-eval: error
+  no-invalid-this: off
+  no-iterator: error
+  no-labels:
+    - error
+    - allowLoop: true
+      allowSwitch: true
+  no-lone-blocks: error
+  no-loop-func: error
+  no-magic-number: off
+  no-multi-spaces: off
+  no-multi-str: off
+  no-native-reassign: error
+  no-new-func: error
+  no-new-wrappers: error
+  no-new: error
+  no-octal-escape: error
+  no-octal: error
+  no-param-reassign: off
+  no-proto: error
+  no-redeclare: error
+  no-restricted-properties: off
+  no-return-assign: error
+  no-return-await: off
+  no-script-url: error
+  no-self-assign: off
+  no-self-compare: error
+  no-sequences: off
+  no-throw-literal: off
+  no-unmodified-loop-condition: off
+  no-unused-expressions: error
+  no-unused-labels: off
+  no-useless-call: error
+  no-useless-concat: error
+  no-useless-escape: off
+  no-useless-return: off
+  no-void: error
+  no-warning-comments: off
+  no-with: error
+  prefer-promise-reject-errors: off
+  radix: error
+  require-await: off
+  vars-on-top: off
+  wrap-iife: error
+  yoda: off
+
+  # Strict
+  strict: off
+
+  # Variables
+  init-declarations: off
+  no-catch-shadow: error
+  no-delete-var: error
+  no-label-var: error
+  no-restricted-globals: off
+  no-shadow-restricted-names: error
+  no-shadow: off
+  no-undef-init: error
+  no-undef: off
+  no-undefined: off
+  no-unused-vars: off
+  no-use-before-define: off
+
+  # Node.js and CommonJS
+  callback-return: error
+  global-require: error
+  handle-callback-err: error
+  no-mixed-requires: off
+  no-new-require: off
+  no-path-concat: error
+  no-process-env: off
+  no-process-exit: error
+  no-restricted-modules: off
+  no-sync: off
+
+  # Stylistic Issues
+  array-bracket-spacing: off
+  block-spacing: off
+  brace-style: off
+  camelcase: off
+  capitalized-comments: off
+  comma-dangle:
+    - error
+    - never
+  comma-spacing: off
+  comma-style: off
+  computed-property-spacing: off
+  consistent-this: off
+  eol-last: off
+  func-call-spacing: off
+  func-name-matching: off
+  func-names: off
+  func-style: off
+  id-length: off
+  id-match: off
+  indent: off
+  jsx-quotes: off
+  key-spacing: off
+  keyword-spacing: off
+  line-comment-position: off
+  linebreak-style:
+    - error
+    - unix
+  lines-around-comment: off
+  lines-around-directive: off
+  max-depth: off
+  max-len: off
+  max-nested-callbacks: off
+  max-params: off
+  max-statements-per-line: off
+  max-statements:
+    - error
+    - 30
+  multiline-ternary: off
+  new-cap: off
+  new-parens: off
+  newline-after-var: off
+  newline-before-return: off
+  newline-per-chained-call: off
+  no-array-constructor: off
+  no-bitwise: off
+  no-continue: off
+  no-inline-comments: off
+  no-lonely-if: off
+  no-mixed-operators: off
+  no-mixed-spaces-and-tabs: off
+  no-multi-assign: off
+  no-multiple-empty-lines: off
+  no-negated-condition: off
+  no-nested-ternary: off
+  no-new-object: off
+  no-plusplus: off
+  no-restricted-syntax: off
+  no-spaced-func: off
+  no-tabs: off
+  no-ternary: off
+  no-trailing-spaces: off
+  no-underscore-dangle: off
+  no-unneeded-ternary: off
+  object-curly-newline: off
+  object-curly-spacing: off
+  object-property-newline: off
+  one-var-declaration-per-line: off
+  one-var: off
+  operator-assignment: off
+  operator-linebreak: off
+  padded-blocks: off
+  quote-props: off
+  quotes:
+    - error
+    - single
+  require-jsdoc: off
+  semi-spacing: off
+  semi:
+    - error
+    - always
+  sort-keys: off
+  sort-vars: off
+  space-before-blocks: off
+  space-before-function-paren: off
+  space-in-parens: off
+  space-infix-ops: off
+  space-unary-ops: off
+  spaced-comment: off
+  template-tag-spacing: off
+  unicode-bom: off
+  wrap-regex: off
+
+  # ECMAScript 6
+  arrow-body-style: off
+  arrow-parens: off
+  arrow-spacing: off
+  constructor-super: off
+  generator-star-spacing: off
+  no-class-assign: off
+  no-confusing-arrow: off
+  no-const-assign: off
+  no-dupe-class-members: off
+  no-duplicate-imports: off
+  no-new-symbol: off
+  no-restricted-imports: off
+  no-this-before-super: off
+  no-useless-computed-key: off
+  no-useless-constructor: off
+  no-useless-rename: off
+  no-var: off
+  object-shorthand: off
+  prefer-arrow-callback: off
+  prefer-const: off
+  prefer-destructuring: off
+  prefer-numeric-literals: off
+  prefer-rest-params: off
+  prefer-reflect: off
+  prefer-spread: off
+  prefer-template: off
+  require-yield: off
+  rest-spread-spacing: off
+  sort-imports: off
+  symbol-description: off
+  template-curly-spacing: off
+  yield-star-spacing: off
@@ -2,7 +2,7 @@

 Thanks for opening an issue on Portainer !

-Do you need help or have a question? Come chat with us on gitter: https://gitter.im/portainer/Lobby.
+Do you need help or have a question? Come chat with us on Slack http://portainer.io/slack/ or gitter https://gitter.im/portainer/Lobby.

 If you are reporting a new issue, make sure that we do not have any duplicates
 already open. You can ensure this by searching the issue list for this
@@ -37,8 +37,8 @@ Any other info e.g. Why do you consider this to be a bug? What did you expect to
 **Technical details:**

 * Portainer version:
-* Portainer Docker image tag (latest/arm/windows...):
 * Target Docker version (the host/cluster you manage):
-* Target Swarm version (if applicable):
 * Platform (windows/linux):
+* Command used to start Portainer (`docker run -p 9000:9000 portainer/portainer`):
+* Target Swarm version (if applicable):
 * Browser:
@@ -0,0 +1,46 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, gender identity and expression, level of experience, nationality, personal appearance, race, religion, or sexual identity and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment include:
+
+* Using welcoming and inclusive language
+* Being respectful of differing viewpoints and experiences
+* Gracefully accepting constructive criticism
+* Focusing on what is best for the community
+* Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery and unwelcome sexual attention or advances
+* Trolling, insulting/derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or electronic address, without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at anthony.lapenna@portainer.io. The project team will review and investigate all complaints, and will respond in a way that it deems appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4, available at [http://contributor-covenant.org/version/1/4][version]
+
+[homepage]: http://contributor-covenant.org
+[version]: http://contributor-covenant.org/version/1/4/
@@ -1,22 +1,26 @@

 <p align="center">
-  <img title="portainer" src='http://portainer.io/images/logo_alt.png' />
+  <img title="portainer" src='https://portainer.io/images/logo_alt.png' />
 </p>

+[![Docker Pulls](https://img.shields.io/docker/pulls/portainer/portainer.svg)](https://hub.docker.com/r/portainer/portainer/)
 [![Microbadger](https://images.microbadger.com/badges/image/portainer/portainer.svg)](http://microbadger.com/images/portainer/portainer "Image size")
-[![Documentation Status](https://readthedocs.org/projects/portainer/badge/?version=stable)](http://portainer.readthedocs.io/en/latest/?badge=stable)
+[![Documentation Status](https://readthedocs.org/projects/portainer/badge/?version=stable)](http://portainer.readthedocs.io/en/stable/?badge=stable)
+[![Codefresh build status]( https://g.codefresh.io/api/badges/build?repoOwner=portainer&repoName=portainer&branch=develop&pipelineName=portainer-ci&accountName=deviantony&type=cf-1)]( https://g.codefresh.io/repositories/portainer/portainer/builds?filter=trigger:build;branch:develop;service:5922a08a3a1aab000116fcc6~portainer-ci)
+[![Code Climate](https://codeclimate.com/github/portainer/portainer/badges/gpa.svg)](https://codeclimate.com/github/portainer/portainer)
+[![Slack](https://portainer.io/slack/badge.svg)](https://portainer.io/slack/)
 [![Gitter](https://badges.gitter.im/portainer/Lobby.svg)](https://gitter.im/portainer/Lobby?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge)
 [![Donate](https://img.shields.io/badge/Donate-PayPal-green.svg)](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=YHXZJQNJQ36H6)

-**_Portainer_** is a lightweight management UI which allows you to **easily** manage your Docker host or Swarm cluster.
+**_Portainer_** is a lightweight management UI which allows you to **easily** manage your different Docker environments (Docker hosts or Swarm clusters).

-**_Portainer_** is meant to be as **simple** to deploy as it is to use. It consists of a single container that can run on any Docker engine (Docker for Linux and Docker for Windows are supported).
+**_Portainer_** is meant to be as **simple** to deploy as it is to use. It consists of a single container that can run on any Docker engine (can be deployed as Linux container or a Windows native container).

-**_Portainer_** allows you to manage your Docker containers, images, volumes, networks and more ! It is compatible with the *standalone Docker* engine and with *Docker Swarm*.
+**_Portainer_** allows you to manage your Docker containers, images, volumes, networks and more ! It is compatible with the *standalone Docker* engine and with *Docker Swarm mode*.

 ## Demo

-<img src="http://portainer.io/images/screenshots/portainer.gif" width="77%"/>
+<img src="https://portainer.io/images/screenshots/portainer.gif" width="77%"/>

 You can try out the public demo instance: http://demo.portainer.io/ (login with the username **admin** and the password **tryportainer**).

@@ -31,8 +35,8 @@ Please note that the public demo cluster is **reset every 15min**.

 * Issues: https://github.com/portainer/portainer/issues
 * FAQ: https://portainer.readthedocs.io/en/latest/faq.html
+* Slack (chat): https://portainer.io/slack/
 * Gitter (chat): https://gitter.im/portainer/Lobby
-* Slack: http://portainer.io/slack/

 ## Reporting bugs and contributing

@@ -43,7 +47,7 @@ Please note that the public demo cluster is **reset every 15min**.

 **_Portainer_** has full support for the following Docker versions:

-* Docker 1.10 to Docker 17.03 (including `swarm-mode`)
+* Docker 1.10 to the latest version
 * Docker Swarm >= 1.2.3

 Partial support for the following Docker versions (some features may not be available):
@@ -17,22 +17,30 @@ type Store struct {

 	// Services
 	UserService            *UserService
+	TeamService            *TeamService
+	TeamMembershipService  *TeamMembershipService
 	EndpointService        *EndpointService
 	ResourceControlService *ResourceControlService
 	VersionService         *VersionService
+	SettingsService        *SettingsService
+	RegistryService        *RegistryService
+	DockerHubService       *DockerHubService

 	db                    *bolt.DB
 	checkForDataMigration bool
 }

 const (
-	databaseFileName                   = "portainer.db"
-	versionBucketName                  = "version"
-	userBucketName                     = "users"
-	endpointBucketName                 = "endpoints"
-	containerResourceControlBucketName = "containerResourceControl"
-	serviceResourceControlBucketName   = "serviceResourceControl"
-	volumeResourceControlBucketName    = "volumeResourceControl"
+	databaseFileName          = "portainer.db"
+	versionBucketName         = "version"
+	userBucketName            = "users"
+	teamBucketName            = "teams"
+	teamMembershipBucketName  = "team_membership"
+	endpointBucketName        = "endpoints"
+	resourceControlBucketName = "resource_control"
+	settingsBucketName        = "settings"
+	registryBucketName        = "registries"
+	dockerhubBucketName       = "dockerhub"
 )

 // NewStore initializes a new Store and the associated services
@@ -40,14 +48,24 @@ func NewStore(storePath string) (*Store, error) {
 	store := &Store{
 		Path:                   storePath,
 		UserService:            &UserService{},
+		TeamService:            &TeamService{},
+		TeamMembershipService:  &TeamMembershipService{},
 		EndpointService:        &EndpointService{},
 		ResourceControlService: &ResourceControlService{},
 		VersionService:         &VersionService{},
+		SettingsService:        &SettingsService{},
+		RegistryService:        &RegistryService{},
+		DockerHubService:       &DockerHubService{},
 	}
 	store.UserService.store = store
+	store.TeamService.store = store
+	store.TeamMembershipService.store = store
 	store.EndpointService.store = store
 	store.ResourceControlService.store = store
 	store.VersionService.store = store
+	store.SettingsService.store = store
+	store.RegistryService.store = store
+	store.DockerHubService.store = store

 	_, err := os.Stat(storePath + "/" + databaseFileName)
 	if err != nil && os.IsNotExist(err) {
@@ -64,36 +82,26 @@ func NewStore(storePath string) (*Store, error) {
 // Open opens and initializes the BoltDB database.
 func (store *Store) Open() error {
 	path := store.Path + "/" + databaseFileName
+
 	db, err := bolt.Open(path, 0600, &bolt.Options{Timeout: 1 * time.Second})
 	if err != nil {
 		return err
 	}
 	store.db = db
+
+	bucketsToCreate := []string{versionBucketName, userBucketName, teamBucketName, endpointBucketName,
+		resourceControlBucketName, teamMembershipBucketName, settingsBucketName,
+		registryBucketName, dockerhubBucketName}
+
 	return db.Update(func(tx *bolt.Tx) error {
-		_, err := tx.CreateBucketIfNotExists([]byte(versionBucketName))
-		if err != nil {
-			return err
-		}
-		_, err = tx.CreateBucketIfNotExists([]byte(userBucketName))
-		if err != nil {
-			return err
-		}
-		_, err = tx.CreateBucketIfNotExists([]byte(endpointBucketName))
-		if err != nil {
-			return err
-		}
-		_, err = tx.CreateBucketIfNotExists([]byte(containerResourceControlBucketName))
-		if err != nil {
-			return err
-		}
-		_, err = tx.CreateBucketIfNotExists([]byte(serviceResourceControlBucketName))
-		if err != nil {
-			return err
-		}
-		_, err = tx.CreateBucketIfNotExists([]byte(volumeResourceControlBucketName))
-		if err != nil {
-			return err
+
+		for _, bucket := range bucketsToCreate {
+			_, err := tx.CreateBucketIfNotExists([]byte(bucket))
+			if err != nil {
+				return err
+			}
 		}
+
 		return nil
 	})
 }
@@ -0,0 +1,61 @@
+package bolt
+
+import (
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/bolt/internal"
+
+	"github.com/boltdb/bolt"
+)
+
+// DockerHubService represents a service for managing registries.
+type DockerHubService struct {
+	store *Store
+}
+
+const (
+	dbDockerHubKey = "DOCKERHUB"
+)
+
+// DockerHub returns the DockerHub object.
+func (service *DockerHubService) DockerHub() (*portainer.DockerHub, error) {
+	var data []byte
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(dockerhubBucketName))
+		value := bucket.Get([]byte(dbDockerHubKey))
+		if value == nil {
+			return portainer.ErrDockerHubNotFound
+		}
+
+		data = make([]byte, len(value))
+		copy(data, value)
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	var dockerhub portainer.DockerHub
+	err = internal.UnmarshalDockerHub(data, &dockerhub)
+	if err != nil {
+		return nil, err
+	}
+	return &dockerhub, nil
+}
+
+// StoreDockerHub persists a DockerHub object.
+func (service *DockerHubService) StoreDockerHub(dockerhub *portainer.DockerHub) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(dockerhubBucketName))
+
+		data, err := internal.MarshalDockerHub(dockerhub)
+		if err != nil {
+			return err
+		}
+
+		err = bucket.Put([]byte(dbDockerHubKey), data)
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
@@ -7,7 +7,7 @@ import (
 	"github.com/boltdb/bolt"
 )

-// EndpointService represents a service for managing users.
+// EndpointService represents a service for managing endpoints.
 type EndpointService struct {
 	store *Store
 }
@@ -17,6 +17,26 @@ func UnmarshalUser(data []byte, user *portainer.User) error {
 	return json.Unmarshal(data, user)
 }

+// MarshalTeam encodes a team to binary format.
+func MarshalTeam(team *portainer.Team) ([]byte, error) {
+	return json.Marshal(team)
+}
+
+// UnmarshalTeam decodes a team from a binary data.
+func UnmarshalTeam(data []byte, team *portainer.Team) error {
+	return json.Unmarshal(data, team)
+}
+
+// MarshalTeamMembership encodes a team membership to binary format.
+func MarshalTeamMembership(membership *portainer.TeamMembership) ([]byte, error) {
+	return json.Marshal(membership)
+}
+
+// UnmarshalTeamMembership decodes a team membership from a binary data.
+func UnmarshalTeamMembership(data []byte, membership *portainer.TeamMembership) error {
+	return json.Unmarshal(data, membership)
+}
+
 // MarshalEndpoint encodes an endpoint to binary format.
 func MarshalEndpoint(endpoint *portainer.Endpoint) ([]byte, error) {
 	return json.Marshal(endpoint)
@@ -27,6 +47,16 @@ func UnmarshalEndpoint(data []byte, endpoint *portainer.Endpoint) error {
 	return json.Unmarshal(data, endpoint)
 }

+// MarshalRegistry encodes a registry to binary format.
+func MarshalRegistry(registry *portainer.Registry) ([]byte, error) {
+	return json.Marshal(registry)
+}
+
+// UnmarshalRegistry decodes a registry from a binary data.
+func UnmarshalRegistry(data []byte, registry *portainer.Registry) error {
+	return json.Unmarshal(data, registry)
+}
+
 // MarshalResourceControl encodes a resource control object to binary format.
 func MarshalResourceControl(rc *portainer.ResourceControl) ([]byte, error) {
 	return json.Marshal(rc)
@@ -37,6 +67,26 @@ func UnmarshalResourceControl(data []byte, rc *portainer.ResourceControl) error
 	return json.Unmarshal(data, rc)
 }

+// MarshalSettings encodes a settings object to binary format.
+func MarshalSettings(settings *portainer.Settings) ([]byte, error) {
+	return json.Marshal(settings)
+}
+
+// UnmarshalSettings decodes a settings object from a binary data.
+func UnmarshalSettings(data []byte, settings *portainer.Settings) error {
+	return json.Unmarshal(data, settings)
+}
+
+// MarshalDockerHub encodes a Dockerhub object to binary format.
+func MarshalDockerHub(settings *portainer.DockerHub) ([]byte, error) {
+	return json.Marshal(settings)
+}
+
+// UnmarshalDockerHub decodes a Dockerhub object from a binary data.
+func UnmarshalDockerHub(data []byte, settings *portainer.DockerHub) error {
+	return json.Unmarshal(data, settings)
+}
+
 // Itob returns an 8-byte big endian representation of v.
 // This function is typically used for encoding integer IDs to byte slices
 // so that they can be used as BoltDB keys.
@@ -0,0 +1,39 @@
+package bolt
+
+import (
+	"github.com/boltdb/bolt"
+	"github.com/portainer/portainer"
+)
+
+func (m *Migrator) updateAdminUserToDBVersion1() error {
+	u, err := m.UserService.UserByUsername("admin")
+	if err == nil {
+		admin := &portainer.User{
+			Username: "admin",
+			Password: u.Password,
+			Role:     portainer.AdministratorRole,
+		}
+		err = m.UserService.CreateUser(admin)
+		if err != nil {
+			return err
+		}
+		err = m.removeLegacyAdminUser()
+		if err != nil {
+			return err
+		}
+	} else if err != nil && err != portainer.ErrUserNotFound {
+		return err
+	}
+	return nil
+}
+
+func (m *Migrator) removeLegacyAdminUser() error {
+	return m.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(userBucketName))
+		err := bucket.Delete([]byte("admin"))
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
@@ -0,0 +1,103 @@
+package bolt
+
+import (
+	"github.com/boltdb/bolt"
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/bolt/internal"
+)
+
+func (m *Migrator) updateResourceControlsToDBVersion2() error {
+	legacyResourceControls, err := m.retrieveLegacyResourceControls()
+	if err != nil {
+		return err
+	}
+
+	for _, resourceControl := range legacyResourceControls {
+		resourceControl.SubResourceIDs = []string{}
+		resourceControl.TeamAccesses = []portainer.TeamResourceAccess{}
+
+		owner, err := m.UserService.User(resourceControl.OwnerID)
+		if err != nil {
+			return err
+		}
+
+		if owner.Role == portainer.AdministratorRole {
+			resourceControl.AdministratorsOnly = true
+			resourceControl.UserAccesses = []portainer.UserResourceAccess{}
+		} else {
+			resourceControl.AdministratorsOnly = false
+			userAccess := portainer.UserResourceAccess{
+				UserID:      resourceControl.OwnerID,
+				AccessLevel: portainer.ReadWriteAccessLevel,
+			}
+			resourceControl.UserAccesses = []portainer.UserResourceAccess{userAccess}
+		}
+
+		err = m.ResourceControlService.CreateResourceControl(&resourceControl)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (m *Migrator) updateEndpointsToDBVersion2() error {
+	legacyEndpoints, err := m.EndpointService.Endpoints()
+	if err != nil {
+		return err
+	}
+
+	for _, endpoint := range legacyEndpoints {
+		endpoint.AuthorizedTeams = []portainer.TeamID{}
+		err = m.EndpointService.UpdateEndpoint(endpoint.ID, &endpoint)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (m *Migrator) retrieveLegacyResourceControls() ([]portainer.ResourceControl, error) {
+	legacyResourceControls := make([]portainer.ResourceControl, 0)
+	err := m.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte("containerResourceControl"))
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var resourceControl portainer.ResourceControl
+			err := internal.UnmarshalResourceControl(v, &resourceControl)
+			if err != nil {
+				return err
+			}
+			resourceControl.Type = portainer.ContainerResourceControl
+			legacyResourceControls = append(legacyResourceControls, resourceControl)
+		}
+
+		bucket = tx.Bucket([]byte("serviceResourceControl"))
+		cursor = bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var resourceControl portainer.ResourceControl
+			err := internal.UnmarshalResourceControl(v, &resourceControl)
+			if err != nil {
+				return err
+			}
+			resourceControl.Type = portainer.ServiceResourceControl
+			legacyResourceControls = append(legacyResourceControls, resourceControl)
+		}
+
+		bucket = tx.Bucket([]byte("volumeResourceControl"))
+		cursor = bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var resourceControl portainer.ResourceControl
+			err := internal.UnmarshalResourceControl(v, &resourceControl)
+			if err != nil {
+				return err
+			}
+			resourceControl.Type = portainer.VolumeResourceControl
+			legacyResourceControls = append(legacyResourceControls, resourceControl)
+		}
+		return nil
+	})
+	return legacyResourceControls, err
+}
@@ -0,0 +1,25 @@
+package bolt
+
+import "github.com/portainer/portainer"
+
+func (m *Migrator) updateSettingsToDBVersion3() error {
+	legacySettings, err := m.SettingsService.Settings()
+	if err != nil {
+		return err
+	}
+
+	legacySettings.AuthenticationMethod = portainer.AuthenticationInternal
+	legacySettings.LDAPSettings = portainer.LDAPSettings{
+		TLSConfig: portainer.TLSConfiguration{},
+		SearchSettings: []portainer.LDAPSearchSettings{
+			portainer.LDAPSearchSettings{},
+		},
+	}
+
+	err = m.SettingsService.StoreSettings(legacySettings)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
@@ -0,0 +1,27 @@
+package bolt
+
+import "github.com/portainer/portainer"
+
+func (m *Migrator) updateEndpointsToDBVersion4() error {
+	legacyEndpoints, err := m.EndpointService.Endpoints()
+	if err != nil {
+		return err
+	}
+
+	for _, endpoint := range legacyEndpoints {
+		endpoint.TLSConfig = portainer.TLSConfiguration{}
+		if endpoint.TLS {
+			endpoint.TLSConfig.TLS = true
+			endpoint.TLSConfig.TLSSkipVerify = false
+			endpoint.TLSConfig.TLSCACertPath = endpoint.TLSCACertPath
+			endpoint.TLSConfig.TLSCertPath = endpoint.TLSCertPath
+			endpoint.TLSConfig.TLSKeyPath = endpoint.TLSKeyPath
+		}
+		err = m.EndpointService.UpdateEndpoint(endpoint.ID, &endpoint)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
@@ -1,35 +1,65 @@
 package bolt

-import (
-	"github.com/boltdb/bolt"
-	"github.com/portainer/portainer"
-)
+import "github.com/portainer/portainer"

+// Migrator defines a service to migrate data after a Portainer version update.
 type Migrator struct {
 	UserService            *UserService
 	EndpointService        *EndpointService
 	ResourceControlService *ResourceControlService
+	SettingsService        *SettingsService
 	VersionService         *VersionService
 	CurrentDBVersion       int
 	store                  *Store
 }

+// NewMigrator creates a new Migrator.
 func NewMigrator(store *Store, version int) *Migrator {
 	return &Migrator{
 		UserService:            store.UserService,
 		EndpointService:        store.EndpointService,
 		ResourceControlService: store.ResourceControlService,
+		SettingsService:        store.SettingsService,
 		VersionService:         store.VersionService,
 		CurrentDBVersion:       version,
 		store:                  store,
 	}
 }

+// Migrate checks the database version and migrate the existing data to the most recent data model.
 func (m *Migrator) Migrate() error {

 	// Portainer < 1.12
-	if m.CurrentDBVersion == 0 {
-		err := m.updateAdminUser()
+	if m.CurrentDBVersion < 1 {
+		err := m.updateAdminUserToDBVersion1()
+		if err != nil {
+			return err
+		}
+	}
+
+	// Portainer 1.12.x
+	if m.CurrentDBVersion < 2 {
+		err := m.updateResourceControlsToDBVersion2()
+		if err != nil {
+			return err
+		}
+		err = m.updateEndpointsToDBVersion2()
+		if err != nil {
+			return err
+		}
+	}
+
+	// Portainer 1.13.x
+	if m.CurrentDBVersion < 3 {
+		err := m.updateSettingsToDBVersion3()
+		if err != nil {
+			return err
+		}
+	}
+
+	// Portainer 1.14.0
+	if m.CurrentDBVersion < 4 {
+		err := m.updateEndpointsToDBVersion4()
 		if err != nil {
 			return err
 		}
@@ -41,36 +71,3 @@ func (m *Migrator) Migrate() error {
 	}
 	return nil
 }
-
-func (m *Migrator) updateAdminUser() error {
-	u, err := m.UserService.UserByUsername("admin")
-	if err == nil {
-		admin := &portainer.User{
-			Username: "admin",
-			Password: u.Password,
-			Role:     portainer.AdministratorRole,
-		}
-		err = m.UserService.CreateUser(admin)
-		if err != nil {
-			return err
-		}
-		err = m.removeLegacyAdminUser()
-		if err != nil {
-			return err
-		}
-	} else if err != nil && err != portainer.ErrUserNotFound {
-		return err
-	}
-	return nil
-}
-
-func (m *Migrator) removeLegacyAdminUser() error {
-	return m.store.db.Update(func(tx *bolt.Tx) error {
-		bucket := tx.Bucket([]byte(userBucketName))
-		err := bucket.Delete([]byte("admin"))
-		if err != nil {
-			return err
-		}
-		return nil
-	})
-}
@@ -0,0 +1,114 @@
+package bolt
+
+import (
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/bolt/internal"
+
+	"github.com/boltdb/bolt"
+)
+
+// RegistryService represents a service for managing registries.
+type RegistryService struct {
+	store *Store
+}
+
+// Registry returns an registry by ID.
+func (service *RegistryService) Registry(ID portainer.RegistryID) (*portainer.Registry, error) {
+	var data []byte
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(registryBucketName))
+		value := bucket.Get(internal.Itob(int(ID)))
+		if value == nil {
+			return portainer.ErrRegistryNotFound
+		}
+
+		data = make([]byte, len(value))
+		copy(data, value)
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	var registry portainer.Registry
+	err = internal.UnmarshalRegistry(data, &registry)
+	if err != nil {
+		return nil, err
+	}
+	return &registry, nil
+}
+
+// Registries returns an array containing all the registries.
+func (service *RegistryService) Registries() ([]portainer.Registry, error) {
+	var registries = make([]portainer.Registry, 0)
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(registryBucketName))
+
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var registry portainer.Registry
+			err := internal.UnmarshalRegistry(v, &registry)
+			if err != nil {
+				return err
+			}
+			registries = append(registries, registry)
+		}
+
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return registries, nil
+}
+
+// CreateRegistry creates a new registry.
+func (service *RegistryService) CreateRegistry(registry *portainer.Registry) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(registryBucketName))
+
+		id, _ := bucket.NextSequence()
+		registry.ID = portainer.RegistryID(id)
+
+		data, err := internal.MarshalRegistry(registry)
+		if err != nil {
+			return err
+		}
+
+		err = bucket.Put(internal.Itob(int(registry.ID)), data)
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// UpdateRegistry updates an registry.
+func (service *RegistryService) UpdateRegistry(ID portainer.RegistryID, registry *portainer.Registry) error {
+	data, err := internal.MarshalRegistry(registry)
+	if err != nil {
+		return err
+	}
+
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(registryBucketName))
+		err = bucket.Put(internal.Itob(int(ID)), data)
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// DeleteRegistry deletes an registry.
+func (service *RegistryService) DeleteRegistry(ID portainer.RegistryID) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(registryBucketName))
+		err := bucket.Delete(internal.Itob(int(ID)))
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
@@ -0,0 +1,148 @@
+package bolt
+
+import (
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/bolt/internal"
+
+	"github.com/boltdb/bolt"
+)
+
+// ResourceControlService represents a service for managing resource controls.
+type ResourceControlService struct {
+	store *Store
+}
+
+// ResourceControl returns a ResourceControl object by ID
+func (service *ResourceControlService) ResourceControl(ID portainer.ResourceControlID) (*portainer.ResourceControl, error) {
+	var data []byte
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(resourceControlBucketName))
+		value := bucket.Get(internal.Itob(int(ID)))
+		if value == nil {
+			return portainer.ErrResourceControlNotFound
+		}
+
+		data = make([]byte, len(value))
+		copy(data, value)
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	var resourceControl portainer.ResourceControl
+	err = internal.UnmarshalResourceControl(data, &resourceControl)
+	if err != nil {
+		return nil, err
+	}
+	return &resourceControl, nil
+}
+
+// ResourceControlByResourceID returns a ResourceControl object by checking if the resourceID is equal
+// to the main ResourceID or in SubResourceIDs
+func (service *ResourceControlService) ResourceControlByResourceID(resourceID string) (*portainer.ResourceControl, error) {
+	var resourceControl *portainer.ResourceControl
+
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(resourceControlBucketName))
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var rc portainer.ResourceControl
+			err := internal.UnmarshalResourceControl(v, &rc)
+			if err != nil {
+				return err
+			}
+			if rc.ResourceID == resourceID {
+				resourceControl = &rc
+			}
+			for _, subResourceID := range rc.SubResourceIDs {
+				if subResourceID == resourceID {
+					resourceControl = &rc
+				}
+			}
+		}
+
+		if resourceControl == nil {
+			return portainer.ErrResourceControlNotFound
+		}
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	return resourceControl, nil
+}
+
+// ResourceControls returns all the ResourceControl objects
+func (service *ResourceControlService) ResourceControls() ([]portainer.ResourceControl, error) {
+	var rcs = make([]portainer.ResourceControl, 0)
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(resourceControlBucketName))
+
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var resourceControl portainer.ResourceControl
+			err := internal.UnmarshalResourceControl(v, &resourceControl)
+			if err != nil {
+				return err
+			}
+			rcs = append(rcs, resourceControl)
+		}
+
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return rcs, nil
+}
+
+// CreateResourceControl creates a new ResourceControl object
+func (service *ResourceControlService) CreateResourceControl(resourceControl *portainer.ResourceControl) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(resourceControlBucketName))
+		id, _ := bucket.NextSequence()
+		resourceControl.ID = portainer.ResourceControlID(id)
+		data, err := internal.MarshalResourceControl(resourceControl)
+		if err != nil {
+			return err
+		}
+
+		err = bucket.Put(internal.Itob(int(resourceControl.ID)), data)
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// UpdateResourceControl saves a ResourceControl object.
+func (service *ResourceControlService) UpdateResourceControl(ID portainer.ResourceControlID, resourceControl *portainer.ResourceControl) error {
+	data, err := internal.MarshalResourceControl(resourceControl)
+	if err != nil {
+		return err
+	}
+
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(resourceControlBucketName))
+		err = bucket.Put(internal.Itob(int(ID)), data)
+
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// DeleteResourceControl deletes a ResourceControl object by ID
+func (service *ResourceControlService) DeleteResourceControl(ID portainer.ResourceControlID) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(resourceControlBucketName))
+		err := bucket.Delete(internal.Itob(int(ID)))
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
@@ -1,110 +0,0 @@
-package bolt
-
-import (
-	"github.com/portainer/portainer"
-	"github.com/portainer/portainer/bolt/internal"
-
-	"github.com/boltdb/bolt"
-)
-
-// ResourceControlService represents a service for managing resource controls.
-type ResourceControlService struct {
-	store *Store
-}
-
-func getBucketNameByResourceControlType(rcType portainer.ResourceControlType) string {
-	bucketName := containerResourceControlBucketName
-	if rcType == portainer.ServiceResourceControl {
-		bucketName = serviceResourceControlBucketName
-	} else if rcType == portainer.VolumeResourceControl {
-		bucketName = volumeResourceControlBucketName
-	}
-	return bucketName
-}
-
-// ResourceControl returns a resource control object by resource ID
-func (service *ResourceControlService) ResourceControl(resourceID string, rcType portainer.ResourceControlType) (*portainer.ResourceControl, error) {
-	var data []byte
-	bucketName := getBucketNameByResourceControlType(rcType)
-	err := service.store.db.View(func(tx *bolt.Tx) error {
-		bucket := tx.Bucket([]byte(bucketName))
-		value := bucket.Get([]byte(resourceID))
-		if value == nil {
-			return nil
-		}
-
-		data = make([]byte, len(value))
-		copy(data, value)
-		return nil
-	})
-	if err != nil {
-		return nil, err
-	}
-	if data == nil {
-		return nil, nil
-	}
-
-	var rc portainer.ResourceControl
-	err = internal.UnmarshalResourceControl(data, &rc)
-	if err != nil {
-		return nil, err
-	}
-	return &rc, nil
-}
-
-// ResourceControls returns all resource control objects
-func (service *ResourceControlService) ResourceControls(rcType portainer.ResourceControlType) ([]portainer.ResourceControl, error) {
-	var rcs = make([]portainer.ResourceControl, 0)
-	bucketName := getBucketNameByResourceControlType(rcType)
-	err := service.store.db.View(func(tx *bolt.Tx) error {
-		bucket := tx.Bucket([]byte(bucketName))
-
-		cursor := bucket.Cursor()
-		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
-			var rc portainer.ResourceControl
-			err := internal.UnmarshalResourceControl(v, &rc)
-			if err != nil {
-				return err
-			}
-			rcs = append(rcs, rc)
-		}
-
-		return nil
-	})
-	if err != nil {
-		return nil, err
-	}
-
-	return rcs, nil
-}
-
-// CreateResourceControl creates a new resource control
-func (service *ResourceControlService) CreateResourceControl(resourceID string, rc *portainer.ResourceControl, rcType portainer.ResourceControlType) error {
-	bucketName := getBucketNameByResourceControlType(rcType)
-	return service.store.db.Update(func(tx *bolt.Tx) error {
-		bucket := tx.Bucket([]byte(bucketName))
-		data, err := internal.MarshalResourceControl(rc)
-		if err != nil {
-			return err
-		}
-
-		err = bucket.Put([]byte(resourceID), data)
-		if err != nil {
-			return err
-		}
-		return nil
-	})
-}
-
-// DeleteResourceControl deletes a resource control object by resource ID
-func (service *ResourceControlService) DeleteResourceControl(resourceID string, rcType portainer.ResourceControlType) error {
-	bucketName := getBucketNameByResourceControlType(rcType)
-	return service.store.db.Update(func(tx *bolt.Tx) error {
-		bucket := tx.Bucket([]byte(bucketName))
-		err := bucket.Delete([]byte(resourceID))
-		if err != nil {
-			return err
-		}
-		return nil
-	})
-}
@@ -0,0 +1,61 @@
+package bolt
+
+import (
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/bolt/internal"
+
+	"github.com/boltdb/bolt"
+)
+
+// SettingsService represents a service to manage application settings.
+type SettingsService struct {
+	store *Store
+}
+
+const (
+	dbSettingsKey = "SETTINGS"
+)
+
+// Settings retrieve the settings object.
+func (service *SettingsService) Settings() (*portainer.Settings, error) {
+	var data []byte
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(settingsBucketName))
+		value := bucket.Get([]byte(dbSettingsKey))
+		if value == nil {
+			return portainer.ErrSettingsNotFound
+		}
+
+		data = make([]byte, len(value))
+		copy(data, value)
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	var settings portainer.Settings
+	err = internal.UnmarshalSettings(data, &settings)
+	if err != nil {
+		return nil, err
+	}
+	return &settings, nil
+}
+
+// StoreSettings persists a Settings object.
+func (service *SettingsService) StoreSettings(settings *portainer.Settings) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(settingsBucketName))
+
+		data, err := internal.MarshalSettings(settings)
+		if err != nil {
+			return err
+		}
+
+		err = bucket.Put([]byte(dbSettingsKey), data)
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
@@ -0,0 +1,217 @@
+package bolt
+
+import (
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/bolt/internal"
+
+	"github.com/boltdb/bolt"
+)
+
+// TeamMembershipService represents a service for managing TeamMembership objects.
+type TeamMembershipService struct {
+	store *Store
+}
+
+// TeamMembership returns a TeamMembership object by ID
+func (service *TeamMembershipService) TeamMembership(ID portainer.TeamMembershipID) (*portainer.TeamMembership, error) {
+	var data []byte
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamMembershipBucketName))
+		value := bucket.Get(internal.Itob(int(ID)))
+		if value == nil {
+			return portainer.ErrTeamMembershipNotFound
+		}
+
+		data = make([]byte, len(value))
+		copy(data, value)
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	var membership portainer.TeamMembership
+	err = internal.UnmarshalTeamMembership(data, &membership)
+	if err != nil {
+		return nil, err
+	}
+	return &membership, nil
+}
+
+// TeamMemberships return an array containing all the TeamMembership objects.
+func (service *TeamMembershipService) TeamMemberships() ([]portainer.TeamMembership, error) {
+	var memberships = make([]portainer.TeamMembership, 0)
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamMembershipBucketName))
+
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var membership portainer.TeamMembership
+			err := internal.UnmarshalTeamMembership(v, &membership)
+			if err != nil {
+				return err
+			}
+			memberships = append(memberships, membership)
+		}
+
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return memberships, nil
+}
+
+// TeamMembershipsByUserID return an array containing all the TeamMembership objects where the specified userID is present.
+func (service *TeamMembershipService) TeamMembershipsByUserID(userID portainer.UserID) ([]portainer.TeamMembership, error) {
+	var memberships = make([]portainer.TeamMembership, 0)
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamMembershipBucketName))
+
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var membership portainer.TeamMembership
+			err := internal.UnmarshalTeamMembership(v, &membership)
+			if err != nil {
+				return err
+			}
+			if membership.UserID == userID {
+				memberships = append(memberships, membership)
+			}
+		}
+
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return memberships, nil
+}
+
+// TeamMembershipsByTeamID return an array containing all the TeamMembership objects where the specified teamID is present.
+func (service *TeamMembershipService) TeamMembershipsByTeamID(teamID portainer.TeamID) ([]portainer.TeamMembership, error) {
+	var memberships = make([]portainer.TeamMembership, 0)
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamMembershipBucketName))
+
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var membership portainer.TeamMembership
+			err := internal.UnmarshalTeamMembership(v, &membership)
+			if err != nil {
+				return err
+			}
+			if membership.TeamID == teamID {
+				memberships = append(memberships, membership)
+			}
+		}
+
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return memberships, nil
+}
+
+// UpdateTeamMembership saves a TeamMembership object.
+func (service *TeamMembershipService) UpdateTeamMembership(ID portainer.TeamMembershipID, membership *portainer.TeamMembership) error {
+	data, err := internal.MarshalTeamMembership(membership)
+	if err != nil {
+		return err
+	}
+
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamMembershipBucketName))
+		err = bucket.Put(internal.Itob(int(ID)), data)
+
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// CreateTeamMembership creates a new TeamMembership object.
+func (service *TeamMembershipService) CreateTeamMembership(membership *portainer.TeamMembership) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamMembershipBucketName))
+
+		id, _ := bucket.NextSequence()
+		membership.ID = portainer.TeamMembershipID(id)
+
+		data, err := internal.MarshalTeamMembership(membership)
+		if err != nil {
+			return err
+		}
+
+		err = bucket.Put(internal.Itob(int(membership.ID)), data)
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// DeleteTeamMembership deletes a TeamMembership object.
+func (service *TeamMembershipService) DeleteTeamMembership(ID portainer.TeamMembershipID) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamMembershipBucketName))
+		err := bucket.Delete(internal.Itob(int(ID)))
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// DeleteTeamMembershipByUserID deletes all the TeamMembership object associated to a UserID.
+func (service *TeamMembershipService) DeleteTeamMembershipByUserID(userID portainer.UserID) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamMembershipBucketName))
+
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var membership portainer.TeamMembership
+			err := internal.UnmarshalTeamMembership(v, &membership)
+			if err != nil {
+				return err
+			}
+			if membership.UserID == userID {
+				err := bucket.Delete(internal.Itob(int(membership.ID)))
+				if err != nil {
+					return err
+				}
+			}
+		}
+
+		return nil
+	})
+}
+
+// DeleteTeamMembershipByTeamID deletes all the TeamMembership object associated to a TeamID.
+func (service *TeamMembershipService) DeleteTeamMembershipByTeamID(teamID portainer.TeamID) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamMembershipBucketName))
+
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var membership portainer.TeamMembership
+			err := internal.UnmarshalTeamMembership(v, &membership)
+			if err != nil {
+				return err
+			}
+			if membership.TeamID == teamID {
+				err := bucket.Delete(internal.Itob(int(membership.ID)))
+				if err != nil {
+					return err
+				}
+			}
+		}
+
+		return nil
+	})
+}
@@ -0,0 +1,144 @@
+package bolt
+
+import (
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/bolt/internal"
+
+	"github.com/boltdb/bolt"
+)
+
+// TeamService represents a service for managing teams.
+type TeamService struct {
+	store *Store
+}
+
+// Team returns a Team by ID
+func (service *TeamService) Team(ID portainer.TeamID) (*portainer.Team, error) {
+	var data []byte
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamBucketName))
+		value := bucket.Get(internal.Itob(int(ID)))
+		if value == nil {
+			return portainer.ErrTeamNotFound
+		}
+
+		data = make([]byte, len(value))
+		copy(data, value)
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	var team portainer.Team
+	err = internal.UnmarshalTeam(data, &team)
+	if err != nil {
+		return nil, err
+	}
+	return &team, nil
+}
+
+// TeamByName returns a team by name.
+func (service *TeamService) TeamByName(name string) (*portainer.Team, error) {
+	var team *portainer.Team
+
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamBucketName))
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var t portainer.Team
+			err := internal.UnmarshalTeam(v, &t)
+			if err != nil {
+				return err
+			}
+			if t.Name == name {
+				team = &t
+			}
+		}
+
+		if team == nil {
+			return portainer.ErrTeamNotFound
+		}
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	return team, nil
+}
+
+// Teams return an array containing all the teams.
+func (service *TeamService) Teams() ([]portainer.Team, error) {
+	var teams = make([]portainer.Team, 0)
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamBucketName))
+
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var team portainer.Team
+			err := internal.UnmarshalTeam(v, &team)
+			if err != nil {
+				return err
+			}
+			teams = append(teams, team)
+		}
+
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return teams, nil
+}
+
+// UpdateTeam saves a Team.
+func (service *TeamService) UpdateTeam(ID portainer.TeamID, team *portainer.Team) error {
+	data, err := internal.MarshalTeam(team)
+	if err != nil {
+		return err
+	}
+
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamBucketName))
+		err = bucket.Put(internal.Itob(int(ID)), data)
+
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// CreateTeam creates a new Team.
+func (service *TeamService) CreateTeam(team *portainer.Team) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamBucketName))
+
+		id, _ := bucket.NextSequence()
+		team.ID = portainer.TeamID(id)
+
+		data, err := internal.MarshalTeam(team)
+		if err != nil {
+			return err
+		}
+
+		err = bucket.Put(internal.Itob(int(team.ID)), data)
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// DeleteTeam deletes a Team.
+func (service *TeamService) DeleteTeam(ID portainer.TeamID) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamBucketName))
+		err := bucket.Delete(internal.Itob(int(ID)))
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
@@ -8,21 +8,21 @@ import (
 	"github.com/boltdb/bolt"
 )

-// EndpointService represents a service for managing users.
+// VersionService represents a service to manage stored versions.
 type VersionService struct {
 	store *Store
 }

 const (
-	DBVersionKey = "DB_VERSION"
+	dBVersionKey = "DB_VERSION"
 )

-// DBVersion the stored database version.
+// DBVersion retrieves the stored database version.
 func (service *VersionService) DBVersion() (int, error) {
 	var data []byte
 	err := service.store.db.View(func(tx *bolt.Tx) error {
 		bucket := tx.Bucket([]byte(versionBucketName))
-		value := bucket.Get([]byte(DBVersionKey))
+		value := bucket.Get([]byte(dBVersionKey))
 		if value == nil {
 			return portainer.ErrDBVersionNotFound
 		}
@@ -49,7 +49,7 @@ func (service *VersionService) StoreDBVersion(version int) error {
 		bucket := tx.Bucket([]byte(versionBucketName))

 		data := []byte(strconv.Itoa(version))
-		err := bucket.Put([]byte(DBVersionKey), data)
+		err := bucket.Put([]byte(dBVersionKey), data)
 		if err != nil {
 			return err
 		}
@@ -1,6 +1,7 @@
 package cli

 import (
+	"log"
 	"time"

 	"github.com/portainer/portainer"
@@ -15,11 +16,12 @@ import (
 type Service struct{}

 const (
-	errInvalidEnpointProtocol  = portainer.Error("Invalid endpoint protocol: Portainer only supports unix:// or tcp://")
-	errSocketNotFound          = portainer.Error("Unable to locate Unix socket")
-	errEndpointsFileNotFound   = portainer.Error("Unable to locate external endpoints file")
-	errInvalidSyncInterval     = portainer.Error("Invalid synchronization interval")
-	errEndpointExcludeExternal = portainer.Error("Cannot use the -H flag mutually with --external-endpoints")
+	errInvalidEndpointProtocol    = portainer.Error("Invalid endpoint protocol: Portainer only supports unix:// or tcp://")
+	errSocketNotFound             = portainer.Error("Unable to locate Unix socket")
+	errEndpointsFileNotFound      = portainer.Error("Unable to locate external endpoints file")
+	errInvalidSyncInterval        = portainer.Error("Invalid synchronization interval")
+	errEndpointExcludeExternal    = portainer.Error("Cannot use the -H flag mutually with --external-endpoints")
+	errNoAuthExcludeAdminPassword = portainer.Error("Cannot use --no-auth with --admin-password")
 )

 // ParseFlags parse the CLI flags and return a portainer.Flags struct
@@ -28,20 +30,25 @@ func (*Service) ParseFlags(version string) (*portainer.CLIFlags, error) {

 	flags := &portainer.CLIFlags{
 		Endpoint:          kingpin.Flag("host", "Dockerd endpoint").Short('H').String(),
-		Logo:              kingpin.Flag("logo", "URL for the logo displayed in the UI").String(),
-		Labels:            pairs(kingpin.Flag("hide-label", "Hide containers with a specific label in the UI").Short('l')),
 		ExternalEndpoints: kingpin.Flag("external-endpoints", "Path to a file defining available endpoints").String(),
 		SyncInterval:      kingpin.Flag("sync-interval", "Duration between each synchronization via the external endpoints source").Default(defaultSyncInterval).String(),
 		Addr:              kingpin.Flag("bind", "Address and port to serve Portainer").Default(defaultBindAddress).Short('p').String(),
 		Assets:            kingpin.Flag("assets", "Path to the assets").Default(defaultAssetsDirectory).Short('a').String(),
 		Data:              kingpin.Flag("data", "Path to the folder where the data is stored").Default(defaultDataDirectory).Short('d').String(),
-		Templates:         kingpin.Flag("templates", "URL to the templates (apps) definitions").Default(defaultTemplatesURL).Short('t').String(),
 		NoAuth:            kingpin.Flag("no-auth", "Disable authentication").Default(defaultNoAuth).Bool(),
-		NoAnalytics:       kingpin.Flag("no-analytics", "Disable Analytics in app").Default(defaultNoAuth).Bool(),
+		NoAnalytics:       kingpin.Flag("no-analytics", "Disable Analytics in app").Default(defaultNoAnalytics).Bool(),
 		TLSVerify:         kingpin.Flag("tlsverify", "TLS support").Default(defaultTLSVerify).Bool(),
 		TLSCacert:         kingpin.Flag("tlscacert", "Path to the CA").Default(defaultTLSCACertPath).String(),
 		TLSCert:           kingpin.Flag("tlscert", "Path to the TLS certificate file").Default(defaultTLSCertPath).String(),
 		TLSKey:            kingpin.Flag("tlskey", "Path to the TLS key").Default(defaultTLSKeyPath).String(),
+		SSL:               kingpin.Flag("ssl", "Secure Portainer instance using SSL").Default(defaultSSL).Bool(),
+		SSLCert:           kingpin.Flag("sslcert", "Path to the SSL certificate used to secure the Portainer instance").Default(defaultSSLCertPath).String(),
+		SSLKey:            kingpin.Flag("sslkey", "Path to the SSL key used to secure the Portainer instance").Default(defaultSSLKeyPath).String(),
+		AdminPassword:     kingpin.Flag("admin-password", "Hashed admin password").String(),
+		// Deprecated flags
+		Labels:    pairs(kingpin.Flag("hide-label", "Hide containers with a specific label in the UI").Short('l')),
+		Logo:      kingpin.Flag("logo", "URL for the logo displayed in the UI").String(),
+		Templates: kingpin.Flag("templates", "URL to the templates (apps) definitions").Short('t').String(),
 	}

 	kingpin.Parse()
@@ -70,13 +77,19 @@ func (*Service) ValidateFlags(flags *portainer.CLIFlags) error {
 		return err
 	}

+	if *flags.NoAuth && (*flags.AdminPassword != "") {
+		return errNoAuthExcludeAdminPassword
+	}
+
+	displayDeprecationWarnings(*flags.Templates, *flags.Logo, *flags.Labels)
+
 	return nil
 }

 func validateEndpoint(endpoint string) error {
 	if endpoint != "" {
 		if !strings.HasPrefix(endpoint, "unix://") && !strings.HasPrefix(endpoint, "tcp://") {
-			return errInvalidEnpointProtocol
+			return errInvalidEndpointProtocol
 		}

 		if strings.HasPrefix(endpoint, "unix://") {
@@ -113,3 +126,15 @@ func validateSyncInterval(syncInterval string) error {
 	}
 	return nil
 }
+
+func displayDeprecationWarnings(templates, logo string, labels []portainer.Pair) {
+	if templates != "" {
+		log.Println("Warning: the --templates / -t flag is deprecated and will be removed in future versions.")
+	}
+	if logo != "" {
+		log.Println("Warning: the --logo flag is deprecated and will be removed in future versions.")
+	}
+	if labels != nil {
+		log.Println("Warning: the --hide-label / -l flag is deprecated and will be removed in future versions.")
+	}
+}
@@ -6,12 +6,14 @@ const (
 	defaultBindAddress     = ":9000"
 	defaultDataDirectory   = "/data"
 	defaultAssetsDirectory = "."
-	defaultTemplatesURL    = "https://raw.githubusercontent.com/portainer/templates/master/templates.json"
 	defaultNoAuth          = "false"
 	defaultNoAnalytics     = "false"
 	defaultTLSVerify       = "false"
 	defaultTLSCACertPath   = "/certs/ca.pem"
 	defaultTLSCertPath     = "/certs/cert.pem"
 	defaultTLSKeyPath      = "/certs/key.pem"
+	defaultSSL             = "false"
+	defaultSSLCertPath     = "/certs/portainer.crt"
+	defaultSSLKeyPath      = "/certs/portainer.key"
 	defaultSyncInterval    = "60s"
 )
@@ -4,12 +4,14 @@ const (
 	defaultBindAddress     = ":9000"
 	defaultDataDirectory   = "C:\\data"
 	defaultAssetsDirectory = "."
-	defaultTemplatesURL    = "https://raw.githubusercontent.com/portainer/templates/master/templates.json"
 	defaultNoAuth          = "false"
 	defaultNoAnalytics     = "false"
 	defaultTLSVerify       = "false"
 	defaultTLSCACertPath   = "C:\\certs\\ca.pem"
 	defaultTLSCertPath     = "C:\\certs\\cert.pem"
 	defaultTLSKeyPath      = "C:\\certs\\key.pem"
+	defaultSSL             = "false"
+	defaultSSLCertPath     = "C:\\certs\\portainer.crt"
+	defaultSSLKeyPath      = "C:\\certs\\portainer.key"
 	defaultSyncInterval    = "60s"
 )
@@ -9,6 +9,7 @@ import (
 	"github.com/portainer/portainer/file"
 	"github.com/portainer/portainer/http"
 	"github.com/portainer/portainer/jwt"
+	"github.com/portainer/portainer/ldap"

 	"log"
 )
@@ -68,6 +69,10 @@ func initCryptoService() portainer.CryptoService {
 	return &crypto.Service{}
 }

+func initLDAPService() portainer.LDAPService {
+	return &ldap.Service{}
+}
+
 func initEndpointWatcher(endpointService portainer.EndpointService, externalEnpointFile string, syncInterval string) bool {
 	authorizeEndpointMgmt := true
 	if externalEnpointFile != "" {
@@ -82,16 +87,66 @@ func initEndpointWatcher(endpointService portainer.EndpointService, externalEnpo
 	return authorizeEndpointMgmt
 }

-func initSettings(authorizeEndpointMgmt bool, flags *portainer.CLIFlags) *portainer.Settings {
-	return &portainer.Settings{
-		HiddenLabels:       *flags.Labels,
-		Logo:               *flags.Logo,
+func initStatus(authorizeEndpointMgmt bool, flags *portainer.CLIFlags) *portainer.Status {
+	return &portainer.Status{
 		Analytics:          !*flags.NoAnalytics,
 		Authentication:     !*flags.NoAuth,
 		EndpointManagement: authorizeEndpointMgmt,
+		Version:            portainer.APIVersion,
 	}
 }

+func initDockerHub(dockerHubService portainer.DockerHubService) error {
+	_, err := dockerHubService.DockerHub()
+	if err == portainer.ErrDockerHubNotFound {
+		dockerhub := &portainer.DockerHub{
+			Authentication: false,
+			Username:       "",
+			Password:       "",
+		}
+		return dockerHubService.StoreDockerHub(dockerhub)
+	} else if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func initSettings(settingsService portainer.SettingsService, flags *portainer.CLIFlags) error {
+	_, err := settingsService.Settings()
+	if err == portainer.ErrSettingsNotFound {
+		settings := &portainer.Settings{
+			LogoURL:                     *flags.Logo,
+			DisplayExternalContributors: true,
+			AuthenticationMethod:        portainer.AuthenticationInternal,
+			LDAPSettings: portainer.LDAPSettings{
+				TLSConfig: portainer.TLSConfiguration{},
+				SearchSettings: []portainer.LDAPSearchSettings{
+					portainer.LDAPSearchSettings{},
+				},
+			},
+		}
+
+		if *flags.Templates != "" {
+			settings.TemplatesURL = *flags.Templates
+		} else {
+			settings.TemplatesURL = portainer.DefaultTemplatesURL
+		}
+
+		if *flags.Labels != nil {
+			settings.BlackListedLabels = *flags.Labels
+		} else {
+			settings.BlackListedLabels = make([]portainer.Pair, 0)
+		}
+
+		return settingsService.StoreSettings(settings)
+	} else if err != nil {
+		return err
+	}
+
+	return nil
+}
+
 func retrieveFirstEndpointFromDatabase(endpointService portainer.EndpointService) *portainer.Endpoint {
 	endpoints, err := endpointService.Endpoints()
 	if err != nil {
@@ -112,9 +167,21 @@ func main() {

 	cryptoService := initCryptoService()

+	ldapService := initLDAPService()
+
 	authorizeEndpointMgmt := initEndpointWatcher(store.EndpointService, *flags.ExternalEndpoints, *flags.SyncInterval)

-	settings := initSettings(authorizeEndpointMgmt, flags)
+	err := initSettings(store.SettingsService, flags)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	err = initDockerHub(store.DockerHubService)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	applicationStatus := initStatus(authorizeEndpointMgmt, flags)

 	if *flags.Endpoint != "" {
 		var endpoints []portainer.Endpoint
@@ -124,12 +191,17 @@ func main() {
 		}
 		if len(endpoints) == 0 {
 			endpoint := &portainer.Endpoint{
-				Name:          "primary",
-				URL:           *flags.Endpoint,
-				TLS:           *flags.TLSVerify,
-				TLSCACertPath: *flags.TLSCacert,
-				TLSCertPath:   *flags.TLSCert,
-				TLSKeyPath:    *flags.TLSKey,
+				Name: "primary",
+				URL:  *flags.Endpoint,
+				TLSConfig: portainer.TLSConfiguration{
+					TLS:           *flags.TLSVerify,
+					TLSSkipVerify: false,
+					TLSCACertPath: *flags.TLSCacert,
+					TLSCertPath:   *flags.TLSCert,
+					TLSKeyPath:    *flags.TLSKey,
+				},
+				AuthorizedUsers: []portainer.UserID{},
+				AuthorizedTeams: []portainer.TeamID{},
 			}
 			err = store.EndpointService.CreateEndpoint(endpoint)
 			if err != nil {
@@ -140,23 +212,44 @@ func main() {
 		}
 	}

+	if *flags.AdminPassword != "" {
+		log.Printf("Creating admin user with password hash %s", *flags.AdminPassword)
+		user := &portainer.User{
+			Username: "admin",
+			Role:     portainer.AdministratorRole,
+			Password: *flags.AdminPassword,
+		}
+		err := store.UserService.CreateUser(user)
+		if err != nil {
+			log.Fatal(err)
+		}
+	}
+
 	var server portainer.Server = &http.Server{
+		Status:                 applicationStatus,
 		BindAddress:            *flags.Addr,
 		AssetsPath:             *flags.Assets,
-		Settings:               settings,
-		TemplatesURL:           *flags.Templates,
 		AuthDisabled:           *flags.NoAuth,
 		EndpointManagement:     authorizeEndpointMgmt,
 		UserService:            store.UserService,
+		TeamService:            store.TeamService,
+		TeamMembershipService:  store.TeamMembershipService,
 		EndpointService:        store.EndpointService,
 		ResourceControlService: store.ResourceControlService,
+		SettingsService:        store.SettingsService,
+		RegistryService:        store.RegistryService,
+		DockerHubService:       store.DockerHubService,
 		CryptoService:          cryptoService,
 		JWTService:             jwtService,
 		FileService:            fileService,
+		LDAPService:            ldapService,
+		SSL:                    *flags.SSL,
+		SSLCert:                *flags.SSLCert,
+		SSLKey:                 *flags.SSLKey,
 	}

-	log.Printf("Starting Portainer on %s", *flags.Addr)
-	err := server.Start()
+	log.Printf("Starting Portainer %s on %s", portainer.APIVersion, *flags.Addr)
+	err = server.Start()
 	if err != nil {
 		log.Fatal(err)
 	}
@@ -22,6 +22,16 @@ type (
 		endpointsToUpdate []*portainer.Endpoint
 		endpointsToDelete []*portainer.Endpoint
 	}
+
+	fileEndpoint struct {
+		Name          string `json:"Name"`
+		URL           string `json:"URL"`
+		TLS           bool   `json:"TLS,omitempty"`
+		TLSSkipVerify bool   `json:"TLSSkipVerify,omitempty"`
+		TLSCACert     string `json:"TLSCACert,omitempty"`
+		TLSCert       string `json:"TLSCert,omitempty"`
+		TLSKey        string `json:"TLSKey,omitempty"`
+	}
 )

 const (
@@ -55,6 +65,28 @@ func isValidEndpoint(endpoint *portainer.Endpoint) bool {
 	return false
 }

+func convertFileEndpoints(fileEndpoints []fileEndpoint) []portainer.Endpoint {
+	convertedEndpoints := make([]portainer.Endpoint, 0)
+
+	for _, e := range fileEndpoints {
+		endpoint := portainer.Endpoint{
+			Name:      e.Name,
+			URL:       e.URL,
+			TLSConfig: portainer.TLSConfiguration{},
+		}
+		if e.TLS {
+			endpoint.TLSConfig.TLS = true
+			endpoint.TLSConfig.TLSSkipVerify = e.TLSSkipVerify
+			endpoint.TLSConfig.TLSCACertPath = e.TLSCACert
+			endpoint.TLSConfig.TLSCertPath = e.TLSCert
+			endpoint.TLSConfig.TLSKeyPath = e.TLSKey
+		}
+		convertedEndpoints = append(convertedEndpoints, endpoint)
+	}
+
+	return convertedEndpoints
+}
+
 func endpointExists(endpoint *portainer.Endpoint, endpoints []portainer.Endpoint) int {
 	for idx, v := range endpoints {
 		if endpoint.Name == v.Name && isValidEndpoint(&v) {
@@ -66,22 +98,25 @@ func endpointExists(endpoint *portainer.Endpoint, endpoints []portainer.Endpoint

 func mergeEndpointIfRequired(original, updated *portainer.Endpoint) *portainer.Endpoint {
 	var endpoint *portainer.Endpoint
-	if original.URL != updated.URL || original.TLS != updated.TLS ||
-		(updated.TLS && original.TLSCACertPath != updated.TLSCACertPath) ||
-		(updated.TLS && original.TLSCertPath != updated.TLSCertPath) ||
-		(updated.TLS && original.TLSKeyPath != updated.TLSKeyPath) {
+	if original.URL != updated.URL || original.TLSConfig.TLS != updated.TLSConfig.TLS ||
+		(updated.TLSConfig.TLS && original.TLSConfig.TLSSkipVerify != updated.TLSConfig.TLSSkipVerify) ||
+		(updated.TLSConfig.TLS && original.TLSConfig.TLSCACertPath != updated.TLSConfig.TLSCACertPath) ||
+		(updated.TLSConfig.TLS && original.TLSConfig.TLSCertPath != updated.TLSConfig.TLSCertPath) ||
+		(updated.TLSConfig.TLS && original.TLSConfig.TLSKeyPath != updated.TLSConfig.TLSKeyPath) {
 		endpoint = original
 		endpoint.URL = updated.URL
-		if updated.TLS {
-			endpoint.TLS = true
-			endpoint.TLSCACertPath = updated.TLSCACertPath
-			endpoint.TLSCertPath = updated.TLSCertPath
-			endpoint.TLSKeyPath = updated.TLSKeyPath
+		if updated.TLSConfig.TLS {
+			endpoint.TLSConfig.TLS = true
+			endpoint.TLSConfig.TLSSkipVerify = updated.TLSConfig.TLSSkipVerify
+			endpoint.TLSConfig.TLSCACertPath = updated.TLSConfig.TLSCACertPath
+			endpoint.TLSConfig.TLSCertPath = updated.TLSConfig.TLSCertPath
+			endpoint.TLSConfig.TLSKeyPath = updated.TLSConfig.TLSKeyPath
 		} else {
-			endpoint.TLS = false
-			endpoint.TLSCACertPath = ""
-			endpoint.TLSCertPath = ""
-			endpoint.TLSKeyPath = ""
+			endpoint.TLSConfig.TLS = false
+			endpoint.TLSConfig.TLSSkipVerify = false
+			endpoint.TLSConfig.TLSCACertPath = ""
+			endpoint.TLSConfig.TLSCertPath = ""
+			endpoint.TLSConfig.TLSKeyPath = ""
 		}
 	}
 	return endpoint
@@ -117,7 +152,7 @@ func (job endpointSyncJob) prepareSyncData(storedEndpoints, fileEndpoints []port
 	}

 	for idx, endpoint := range fileEndpoints {
-		if endpoint.Name == "" || endpoint.URL == "" {
+		if !isValidEndpoint(&endpoint) {
 			job.logger.Printf("Invalid file endpoint definition, skipping. [name: %v] [url: %v]", endpoint.Name, endpoint.URL)
 			continue
 		}
@@ -141,7 +176,7 @@ func (job endpointSyncJob) Sync() error {
 		return err
 	}

-	var fileEndpoints []portainer.Endpoint
+	var fileEndpoints []fileEndpoint
 	err = json.Unmarshal(data, &fileEndpoints)
 	if endpointSyncError(err, job.logger) {
 		return err
@@ -156,7 +191,9 @@ func (job endpointSyncJob) Sync() error {
 		return err
 	}

-	sync := job.prepareSyncData(storedEndpoints, fileEndpoints)
+	convertedFileEndpoints := convertFileEndpoints(fileEndpoints)
+
+	sync := job.prepareSyncData(storedEndpoints, convertedFileEndpoints)
 	if sync.requireSync() {
 		err = job.endpointService.Synchronize(sync.endpointsToCreate, sync.endpointsToUpdate, sync.endpointsToDelete)
 		if endpointSyncError(err, job.logger) {
@@ -0,0 +1,39 @@
+package crypto
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"io/ioutil"
+
+	"github.com/portainer/portainer"
+)
+
+// CreateTLSConfiguration initializes a tls.Config using a CA certificate, a certificate and a key
+func CreateTLSConfiguration(config *portainer.TLSConfiguration) (*tls.Config, error) {
+	TLSConfig := &tls.Config{}
+
+	if config.TLSCertPath != "" && config.TLSKeyPath != "" {
+		cert, err := tls.LoadX509KeyPair(config.TLSCertPath, config.TLSKeyPath)
+		if err != nil {
+			return nil, err
+		}
+
+		TLSConfig.Certificates = []tls.Certificate{cert}
+	}
+
+	if !config.TLSSkipVerify {
+		caCert, err := ioutil.ReadFile(config.TLSCACertPath)
+		if err != nil {
+			return nil, err
+		}
+
+		caCertPool := x509.NewCertPool()
+		caCertPool.AppendCertsFromPEM(caCert)
+
+		TLSConfig.RootCAs = caCertPool
+	}
+
+	TLSConfig.InsecureSkipVerify = config.TLSSkipVerify
+
+	return TLSConfig, nil
+}
@@ -2,15 +2,40 @@ package portainer

 // General errors.
 const (
-	ErrUnauthorized         = Error("Unauthorized")
-	ErrResourceAccessDenied = Error("Access denied to resource")
+	ErrUnauthorized           = Error("Unauthorized")
+	ErrResourceAccessDenied   = Error("Access denied to resource")
+	ErrResourceNotFound       = Error("Unable to find resource")
+	ErrUnsupportedDockerAPI   = Error("Unsupported Docker API response")
+	ErrMissingSecurityContext = Error("Unable to find security details in request context")
 )

 // User errors.
 const (
 	ErrUserNotFound            = Error("User not found")
 	ErrUserAlreadyExists       = Error("User already exists")
-	ErrAdminAlreadyInitialized = Error("Admin user already initialized")
+	ErrInvalidUsername         = Error("Invalid username. White spaces are not allowed")
+	ErrAdminAlreadyInitialized = Error("An administrator user already exists")
+	ErrCannotRemoveAdmin       = Error("Cannot remove the default administrator account")
+	ErrAdminCannotRemoveSelf   = Error("Cannot remove your own user account. Contact another administrator")
+)
+
+// Team errors.
+const (
+	ErrTeamNotFound      = Error("Team not found")
+	ErrTeamAlreadyExists = Error("Team already exists")
+)
+
+// TeamMembership errors.
+const (
+	ErrTeamMembershipNotFound      = Error("Team membership not found")
+	ErrTeamMembershipAlreadyExists = Error("Team membership already exists for this user and team.")
+)
+
+// ResourceControl errors.
+const (
+	ErrResourceControlNotFound      = Error("Resource control not found")
+	ErrResourceControlAlreadyExists = Error("A resource control is already applied on this resource")
+	ErrInvalidResourceControlType   = Error("Unsupported resource control type")
 )

 // Endpoint errors.
@@ -19,11 +44,27 @@ const (
 	ErrEndpointAccessDenied = Error("Access denied to endpoint")
 )

+// Registry errors.
+const (
+	ErrRegistryNotFound      = Error("Registry not found")
+	ErrRegistryAlreadyExists = Error("A registry is already defined for this URL")
+)
+
 // Version errors.
 const (
 	ErrDBVersionNotFound = Error("DB version not found")
 )

+// Settings errors.
+const (
+	ErrSettingsNotFound = Error("Settings not found")
+)
+
+// DockerHub errors.
+const (
+	ErrDockerHubNotFound = Error("Dockerhub not found")
+)
+
 // Crypto errors.
 const (
 	ErrCryptoHashFailure = Error("Unable to hash data")
@@ -6,12 +6,13 @@ import (
 	"io"
 	"os"
 	"path"
-	"strconv"
 )

 const (
 	// TLSStorePath represents the subfolder where TLS files are stored in the file store folder.
 	TLSStorePath = "tls"
+	// LDAPStorePath represents the subfolder where LDAP TLS files are stored in the TLSStorePath.
+	LDAPStorePath = "ldap"
 	// TLSCACertFile represents the name on disk for a TLS CA file.
 	TLSCACertFile = "ca.pem"
 	// TLSCertFile represents the name on disk for a TLS certificate file.
@@ -50,11 +51,10 @@ func NewService(dataStorePath, fileStorePath string) (*Service, error) {
 	return service, nil
 }

-// StoreTLSFile creates a subfolder in the TLSStorePath and stores a new file with the content from r.
-func (service *Service) StoreTLSFile(endpointID portainer.EndpointID, fileType portainer.TLSFileType, r io.Reader) error {
-	ID := strconv.Itoa(int(endpointID))
-	endpointStorePath := path.Join(TLSStorePath, ID)
-	err := service.createDirectoryInStoreIfNotExist(endpointStorePath)
+// StoreTLSFile creates a folder in the TLSStorePath and stores a new file with the content from r.
+func (service *Service) StoreTLSFile(folder string, fileType portainer.TLSFileType, r io.Reader) error {
+	storePath := path.Join(TLSStorePath, folder)
+	err := service.createDirectoryInStoreIfNotExist(storePath)
 	if err != nil {
 		return err
 	}
@@ -71,7 +71,7 @@ func (service *Service) StoreTLSFile(endpointID portainer.EndpointID, fileType p
 		return portainer.ErrUndefinedTLSFileType
 	}

-	tlsFilePath := path.Join(endpointStorePath, fileName)
+	tlsFilePath := path.Join(storePath, fileName)
 	err = service.createFileInStore(tlsFilePath, r)
 	if err != nil {
 		return err
@@ -80,7 +80,7 @@ func (service *Service) StoreTLSFile(endpointID portainer.EndpointID, fileType p
 }

 // GetPathForTLSFile returns the absolute path to a specific TLS file for an endpoint.
-func (service *Service) GetPathForTLSFile(endpointID portainer.EndpointID, fileType portainer.TLSFileType) (string, error) {
+func (service *Service) GetPathForTLSFile(folder string, fileType portainer.TLSFileType) (string, error) {
 	var fileName string
 	switch fileType {
 	case portainer.TLSFileCA:
@@ -92,15 +92,36 @@ func (service *Service) GetPathForTLSFile(endpointID portainer.EndpointID, fileT
 	default:
 		return "", portainer.ErrUndefinedTLSFileType
 	}
-	ID := strconv.Itoa(int(endpointID))
-	return path.Join(service.fileStorePath, TLSStorePath, ID, fileName), nil
+	return path.Join(service.fileStorePath, TLSStorePath, folder, fileName), nil
 }

-// DeleteTLSFiles deletes a folder containing the TLS files for an endpoint.
-func (service *Service) DeleteTLSFiles(endpointID portainer.EndpointID) error {
-	ID := strconv.Itoa(int(endpointID))
-	endpointPath := path.Join(service.fileStorePath, TLSStorePath, ID)
-	err := os.RemoveAll(endpointPath)
+// DeleteTLSFiles deletes a folder in the TLS store path.
+func (service *Service) DeleteTLSFiles(folder string) error {
+	storePath := path.Join(service.fileStorePath, TLSStorePath, folder)
+	err := os.RemoveAll(storePath)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+// DeleteTLSFile deletes a specific TLS file from a folder.
+func (service *Service) DeleteTLSFile(folder string, fileType portainer.TLSFileType) error {
+	var fileName string
+	switch fileType {
+	case portainer.TLSFileCA:
+		fileName = TLSCACertFile
+	case portainer.TLSFileCert:
+		fileName = TLSCertFile
+	case portainer.TLSFileKey:
+		fileName = TLSKeyFile
+	default:
+		return portainer.ErrUndefinedTLSFileType
+	}
+
+	filePath := path.Join(service.fileStorePath, TLSStorePath, folder, fileName)
+
+	err := os.Remove(filePath)
 	if err != nil {
 		return err
 	}
@@ -1,109 +0,0 @@
-package http
-
-import (
-	"github.com/portainer/portainer"
-
-	"encoding/json"
-	"log"
-	"net/http"
-	"os"
-
-	"github.com/asaskevich/govalidator"
-	"github.com/gorilla/mux"
-)
-
-// AuthHandler represents an HTTP API handler for managing authentication.
-type AuthHandler struct {
-	*mux.Router
-	Logger        *log.Logger
-	authDisabled  bool
-	UserService   portainer.UserService
-	CryptoService portainer.CryptoService
-	JWTService    portainer.JWTService
-}
-
-const (
-	// ErrInvalidCredentialsFormat is an error raised when credentials format is not valid
-	ErrInvalidCredentialsFormat = portainer.Error("Invalid credentials format")
-	// ErrInvalidCredentials is an error raised when credentials for a user are invalid
-	ErrInvalidCredentials = portainer.Error("Invalid credentials")
-	// ErrAuthDisabled is an error raised when trying to access the authentication endpoints
-	// when the server has been started with the --no-auth flag
-	ErrAuthDisabled = portainer.Error("Authentication is disabled")
-)
-
-// NewAuthHandler returns a new instance of AuthHandler.
-func NewAuthHandler(mw *middleWareService) *AuthHandler {
-	h := &AuthHandler{
-		Router: mux.NewRouter(),
-		Logger: log.New(os.Stderr, "", log.LstdFlags),
-	}
-	h.Handle("/auth",
-		mw.public(http.HandlerFunc(h.handlePostAuth)))
-
-	return h
-}
-
-func (handler *AuthHandler) handlePostAuth(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		handleNotAllowed(w, []string{http.MethodPost})
-		return
-	}
-
-	if handler.authDisabled {
-		Error(w, ErrAuthDisabled, http.StatusServiceUnavailable, handler.Logger)
-		return
-	}
-
-	var req postAuthRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		Error(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	_, err := govalidator.ValidateStruct(req)
-	if err != nil {
-		Error(w, ErrInvalidCredentialsFormat, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	var username = req.Username
-	var password = req.Password
-
-	u, err := handler.UserService.UserByUsername(username)
-	if err == portainer.ErrUserNotFound {
-		Error(w, err, http.StatusNotFound, handler.Logger)
-		return
-	} else if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-
-	err = handler.CryptoService.CompareHashAndData(u.Password, password)
-	if err != nil {
-		Error(w, ErrInvalidCredentials, http.StatusUnprocessableEntity, handler.Logger)
-		return
-	}
-
-	tokenData := &portainer.TokenData{
-		ID:       u.ID,
-		Username: u.Username,
-		Role:     u.Role,
-	}
-	token, err := handler.JWTService.GenerateToken(tokenData)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-
-	encodeJSON(w, &postAuthResponse{JWT: token}, handler.Logger)
-}
-
-type postAuthRequest struct {
-	Username string `valid:"alphanum,required"`
-	Password string `valid:"required"`
-}
-
-type postAuthResponse struct {
-	JWT string `json:"jwt"`
-}
@@ -1,114 +0,0 @@
-package http
-
-import (
-	"strconv"
-
-	"github.com/portainer/portainer"
-
-	"log"
-	"net/http"
-	"net/url"
-	"os"
-
-	"github.com/gorilla/mux"
-	"github.com/orcaman/concurrent-map"
-)
-
-// DockerHandler represents an HTTP API handler for proxying requests to the Docker API.
-type DockerHandler struct {
-	*mux.Router
-	Logger          *log.Logger
-	EndpointService portainer.EndpointService
-	ProxyFactory    ProxyFactory
-	proxies         cmap.ConcurrentMap
-}
-
-// NewDockerHandler returns a new instance of DockerHandler.
-func NewDockerHandler(mw *middleWareService, resourceControlService portainer.ResourceControlService) *DockerHandler {
-	h := &DockerHandler{
-		Router: mux.NewRouter(),
-		Logger: log.New(os.Stderr, "", log.LstdFlags),
-		ProxyFactory: ProxyFactory{
-			ResourceControlService: resourceControlService,
-		},
-		proxies: cmap.New(),
-	}
-	h.PathPrefix("/{id}/").Handler(
-		mw.authenticated(http.HandlerFunc(h.proxyRequestsToDockerAPI)))
-	return h
-}
-
-func checkEndpointAccessControl(endpoint *portainer.Endpoint, userID portainer.UserID) bool {
-	for _, authorizedUserID := range endpoint.AuthorizedUsers {
-		if authorizedUserID == userID {
-			return true
-		}
-	}
-	return false
-}
-
-func (handler *DockerHandler) proxyRequestsToDockerAPI(w http.ResponseWriter, r *http.Request) {
-	vars := mux.Vars(r)
-	id := vars["id"]
-
-	parsedID, err := strconv.Atoi(id)
-	if err != nil {
-		Error(w, err, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	endpointID := portainer.EndpointID(parsedID)
-	endpoint, err := handler.EndpointService.Endpoint(endpointID)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-
-	tokenData, err := extractTokenDataFromRequestContext(r)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-	}
-	if tokenData.Role != portainer.AdministratorRole && !checkEndpointAccessControl(endpoint, tokenData.ID) {
-		Error(w, portainer.ErrEndpointAccessDenied, http.StatusForbidden, handler.Logger)
-		return
-	}
-
-	var proxy http.Handler
-	item, ok := handler.proxies.Get(string(endpointID))
-	if !ok {
-		proxy, err = handler.createAndRegisterEndpointProxy(endpoint)
-		if err != nil {
-			Error(w, err, http.StatusBadRequest, handler.Logger)
-			return
-		}
-	} else {
-		proxy = item.(http.Handler)
-	}
-	http.StripPrefix("/"+id, proxy).ServeHTTP(w, r)
-}
-
-func (handler *DockerHandler) createAndRegisterEndpointProxy(endpoint *portainer.Endpoint) (http.Handler, error) {
-	var proxy http.Handler
-
-	endpointURL, err := url.Parse(endpoint.URL)
-	if err != nil {
-		return nil, err
-	}
-
-	if endpointURL.Scheme == "tcp" {
-		if endpoint.TLS {
-			proxy, err = handler.ProxyFactory.newHTTPSProxy(endpointURL, endpoint)
-			if err != nil {
-				return nil, err
-			}
-		} else {
-			proxy = handler.ProxyFactory.newHTTPProxy(endpointURL)
-		}
-	} else {
-		// Assume unix:// scheme
-		proxy = handler.ProxyFactory.newSocketProxy(endpointURL.Path)
-	}
-
-	handler.proxies.Set(string(endpoint.ID), proxy)
-	return proxy, nil
-}
@@ -1,121 +0,0 @@
-package http
-
-import (
-	"io"
-	"net"
-	"net/http"
-	"net/http/httputil"
-	"net/url"
-	"strings"
-
-	"github.com/portainer/portainer"
-)
-
-// ProxyFactory is a factory to create reverse proxies to Docker endpoints
-type ProxyFactory struct {
-	ResourceControlService portainer.ResourceControlService
-}
-
-// singleJoiningSlash from golang.org/src/net/http/httputil/reverseproxy.go
-// included here for use in NewSingleHostReverseProxyWithHostHeader
-// because its used in NewSingleHostReverseProxy from golang.org/src/net/http/httputil/reverseproxy.go
-func singleJoiningSlash(a, b string) string {
-	aslash := strings.HasSuffix(a, "/")
-	bslash := strings.HasPrefix(b, "/")
-	switch {
-	case aslash && bslash:
-		return a + b[1:]
-	case !aslash && !bslash:
-		return a + "/" + b
-	}
-	return a + b
-}
-
-// NewSingleHostReverseProxyWithHostHeader is based on NewSingleHostReverseProxy
-// from golang.org/src/net/http/httputil/reverseproxy.go and merely sets the Host
-// HTTP header, which NewSingleHostReverseProxy deliberately preserves.
-// It also adds an extra Transport to the proxy to allow Portainer to rewrite the responses.
-func (factory *ProxyFactory) newSingleHostReverseProxyWithHostHeader(target *url.URL) *httputil.ReverseProxy {
-	targetQuery := target.RawQuery
-	director := func(req *http.Request) {
-		req.URL.Scheme = target.Scheme
-		req.URL.Host = target.Host
-		req.URL.Path = singleJoiningSlash(target.Path, req.URL.Path)
-		req.Host = req.URL.Host
-		if targetQuery == "" || req.URL.RawQuery == "" {
-			req.URL.RawQuery = targetQuery + req.URL.RawQuery
-		} else {
-			req.URL.RawQuery = targetQuery + "&" + req.URL.RawQuery
-		}
-		if _, ok := req.Header["User-Agent"]; !ok {
-			// explicitly disable User-Agent so it's not set to default value
-			req.Header.Set("User-Agent", "")
-		}
-	}
-	transport := &proxyTransport{
-		ResourceControlService: factory.ResourceControlService,
-		transport:              &http.Transport{},
-	}
-	return &httputil.ReverseProxy{Director: director, Transport: transport}
-}
-
-func (factory *ProxyFactory) newHTTPProxy(u *url.URL) http.Handler {
-	u.Scheme = "http"
-	return factory.newSingleHostReverseProxyWithHostHeader(u)
-}
-
-func (factory *ProxyFactory) newHTTPSProxy(u *url.URL, endpoint *portainer.Endpoint) (http.Handler, error) {
-	u.Scheme = "https"
-	proxy := factory.newSingleHostReverseProxyWithHostHeader(u)
-	config, err := createTLSConfiguration(endpoint.TLSCACertPath, endpoint.TLSCertPath, endpoint.TLSKeyPath)
-	if err != nil {
-		return nil, err
-	}
-
-	proxy.Transport.(*proxyTransport).transport.TLSClientConfig = config
-	return proxy, nil
-}
-
-func (factory *ProxyFactory) newSocketProxy(path string) http.Handler {
-	return &unixSocketHandler{path, &proxyTransport{
-		ResourceControlService: factory.ResourceControlService,
-	}}
-}
-
-// unixSocketHandler represents a handler to proxy HTTP requests via a unix:// socket
-type unixSocketHandler struct {
-	path      string
-	transport *proxyTransport
-}
-
-func (h *unixSocketHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	conn, err := net.Dial("unix", h.path)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, nil)
-		return
-	}
-	c := httputil.NewClientConn(conn, nil)
-	defer c.Close()
-
-	res, err := c.Do(r)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, nil)
-		return
-	}
-	defer res.Body.Close()
-
-	err = h.transport.proxyDockerRequests(r, res)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, nil)
-		return
-	}
-
-	for k, vv := range res.Header {
-		for _, v := range vv {
-			w.Header().Add(k, v)
-		}
-	}
-	if _, err := io.Copy(w, res.Body); err != nil {
-		Error(w, err, http.StatusInternalServerError, nil)
-	}
-}
@@ -1,335 +0,0 @@
-package http
-
-import (
-	"github.com/portainer/portainer"
-
-	"encoding/json"
-	"log"
-	"net/http"
-	"os"
-	"strconv"
-
-	"github.com/asaskevich/govalidator"
-	"github.com/gorilla/mux"
-)
-
-// EndpointHandler represents an HTTP API handler for managing Docker endpoints.
-type EndpointHandler struct {
-	*mux.Router
-	Logger                      *log.Logger
-	authorizeEndpointManagement bool
-	EndpointService             portainer.EndpointService
-	FileService                 portainer.FileService
-}
-
-const (
-	// ErrEndpointManagementDisabled is an error raised when trying to access the endpoints management endpoints
-	// when the server has been started with the --external-endpoints flag
-	ErrEndpointManagementDisabled = portainer.Error("Endpoint management is disabled")
-)
-
-// NewEndpointHandler returns a new instance of EndpointHandler.
-func NewEndpointHandler(mw *middleWareService) *EndpointHandler {
-	h := &EndpointHandler{
-		Router: mux.NewRouter(),
-		Logger: log.New(os.Stderr, "", log.LstdFlags),
-	}
-	h.Handle("/endpoints",
-		mw.administrator(http.HandlerFunc(h.handlePostEndpoints))).Methods(http.MethodPost)
-	h.Handle("/endpoints",
-		mw.authenticated(http.HandlerFunc(h.handleGetEndpoints))).Methods(http.MethodGet)
-	h.Handle("/endpoints/{id}",
-		mw.administrator(http.HandlerFunc(h.handleGetEndpoint))).Methods(http.MethodGet)
-	h.Handle("/endpoints/{id}",
-		mw.administrator(http.HandlerFunc(h.handlePutEndpoint))).Methods(http.MethodPut)
-	h.Handle("/endpoints/{id}/access",
-		mw.administrator(http.HandlerFunc(h.handlePutEndpointAccess))).Methods(http.MethodPut)
-	h.Handle("/endpoints/{id}",
-		mw.administrator(http.HandlerFunc(h.handleDeleteEndpoint))).Methods(http.MethodDelete)
-
-	return h
-}
-
-// handleGetEndpoints handles GET requests on /endpoints
-func (handler *EndpointHandler) handleGetEndpoints(w http.ResponseWriter, r *http.Request) {
-	endpoints, err := handler.EndpointService.Endpoints()
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-
-	tokenData, err := extractTokenDataFromRequestContext(r)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-	}
-	if tokenData == nil {
-		Error(w, portainer.ErrInvalidJWTToken, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	var allowedEndpoints []portainer.Endpoint
-	if tokenData.Role != portainer.AdministratorRole {
-		allowedEndpoints = make([]portainer.Endpoint, 0)
-		for _, endpoint := range endpoints {
-			for _, authorizedUserID := range endpoint.AuthorizedUsers {
-				if authorizedUserID == tokenData.ID {
-					allowedEndpoints = append(allowedEndpoints, endpoint)
-					break
-				}
-			}
-		}
-	} else {
-		allowedEndpoints = endpoints
-	}
-
-	encodeJSON(w, allowedEndpoints, handler.Logger)
-}
-
-// handlePostEndpoints handles POST requests on /endpoints
-func (handler *EndpointHandler) handlePostEndpoints(w http.ResponseWriter, r *http.Request) {
-	if !handler.authorizeEndpointManagement {
-		Error(w, ErrEndpointManagementDisabled, http.StatusServiceUnavailable, handler.Logger)
-		return
-	}
-
-	var req postEndpointsRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		Error(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	_, err := govalidator.ValidateStruct(req)
-	if err != nil {
-		Error(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	endpoint := &portainer.Endpoint{
-		Name:            req.Name,
-		URL:             req.URL,
-		TLS:             req.TLS,
-		AuthorizedUsers: []portainer.UserID{},
-	}
-
-	err = handler.EndpointService.CreateEndpoint(endpoint)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-
-	if req.TLS {
-		caCertPath, _ := handler.FileService.GetPathForTLSFile(endpoint.ID, portainer.TLSFileCA)
-		endpoint.TLSCACertPath = caCertPath
-		certPath, _ := handler.FileService.GetPathForTLSFile(endpoint.ID, portainer.TLSFileCert)
-		endpoint.TLSCertPath = certPath
-		keyPath, _ := handler.FileService.GetPathForTLSFile(endpoint.ID, portainer.TLSFileKey)
-		endpoint.TLSKeyPath = keyPath
-		err = handler.EndpointService.UpdateEndpoint(endpoint.ID, endpoint)
-		if err != nil {
-			Error(w, err, http.StatusInternalServerError, handler.Logger)
-			return
-		}
-	}
-
-	encodeJSON(w, &postEndpointsResponse{ID: int(endpoint.ID)}, handler.Logger)
-}
-
-type postEndpointsRequest struct {
-	Name string `valid:"required"`
-	URL  string `valid:"required"`
-	TLS  bool
-}
-
-type postEndpointsResponse struct {
-	ID int `json:"Id"`
-}
-
-// handleGetEndpoint handles GET requests on /endpoints/:id
-func (handler *EndpointHandler) handleGetEndpoint(w http.ResponseWriter, r *http.Request) {
-	vars := mux.Vars(r)
-	id := vars["id"]
-
-	endpointID, err := strconv.Atoi(id)
-	if err != nil {
-		Error(w, err, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	endpoint, err := handler.EndpointService.Endpoint(portainer.EndpointID(endpointID))
-	if err == portainer.ErrEndpointNotFound {
-		Error(w, err, http.StatusNotFound, handler.Logger)
-		return
-	} else if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-
-	encodeJSON(w, endpoint, handler.Logger)
-}
-
-// handlePutEndpointAccess handles PUT requests on /endpoints/:id/access
-func (handler *EndpointHandler) handlePutEndpointAccess(w http.ResponseWriter, r *http.Request) {
-	vars := mux.Vars(r)
-	id := vars["id"]
-
-	endpointID, err := strconv.Atoi(id)
-	if err != nil {
-		Error(w, err, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	var req putEndpointAccessRequest
-	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
-		Error(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	_, err = govalidator.ValidateStruct(req)
-	if err != nil {
-		Error(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	endpoint, err := handler.EndpointService.Endpoint(portainer.EndpointID(endpointID))
-	if err == portainer.ErrEndpointNotFound {
-		Error(w, err, http.StatusNotFound, handler.Logger)
-		return
-	} else if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-
-	authorizedUserIDs := []portainer.UserID{}
-	for _, value := range req.AuthorizedUsers {
-		authorizedUserIDs = append(authorizedUserIDs, portainer.UserID(value))
-	}
-	endpoint.AuthorizedUsers = authorizedUserIDs
-
-	err = handler.EndpointService.UpdateEndpoint(endpoint.ID, endpoint)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-}
-
-type putEndpointAccessRequest struct {
-	AuthorizedUsers []int `valid:"-"`
-}
-
-// handlePutEndpoint handles PUT requests on /endpoints/:id
-func (handler *EndpointHandler) handlePutEndpoint(w http.ResponseWriter, r *http.Request) {
-	if !handler.authorizeEndpointManagement {
-		Error(w, ErrEndpointManagementDisabled, http.StatusServiceUnavailable, handler.Logger)
-		return
-	}
-
-	vars := mux.Vars(r)
-	id := vars["id"]
-
-	endpointID, err := strconv.Atoi(id)
-	if err != nil {
-		Error(w, err, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	var req putEndpointsRequest
-	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
-		Error(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	_, err = govalidator.ValidateStruct(req)
-	if err != nil {
-		Error(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	endpoint, err := handler.EndpointService.Endpoint(portainer.EndpointID(endpointID))
-	if err == portainer.ErrEndpointNotFound {
-		Error(w, err, http.StatusNotFound, handler.Logger)
-		return
-	} else if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-
-	if req.Name != "" {
-		endpoint.Name = req.Name
-	}
-
-	if req.URL != "" {
-		endpoint.URL = req.URL
-	}
-
-	if req.TLS {
-		endpoint.TLS = true
-		caCertPath, _ := handler.FileService.GetPathForTLSFile(endpoint.ID, portainer.TLSFileCA)
-		endpoint.TLSCACertPath = caCertPath
-		certPath, _ := handler.FileService.GetPathForTLSFile(endpoint.ID, portainer.TLSFileCert)
-		endpoint.TLSCertPath = certPath
-		keyPath, _ := handler.FileService.GetPathForTLSFile(endpoint.ID, portainer.TLSFileKey)
-		endpoint.TLSKeyPath = keyPath
-	} else {
-		endpoint.TLS = false
-		endpoint.TLSCACertPath = ""
-		endpoint.TLSCertPath = ""
-		endpoint.TLSKeyPath = ""
-		err = handler.FileService.DeleteTLSFiles(endpoint.ID)
-		if err != nil {
-			Error(w, err, http.StatusInternalServerError, handler.Logger)
-			return
-		}
-	}
-
-	err = handler.EndpointService.UpdateEndpoint(endpoint.ID, endpoint)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-}
-
-type putEndpointsRequest struct {
-	Name string `valid:"-"`
-	URL  string `valid:"-"`
-	TLS  bool   `valid:"-"`
-}
-
-// handleDeleteEndpoint handles DELETE requests on /endpoints/:id
-func (handler *EndpointHandler) handleDeleteEndpoint(w http.ResponseWriter, r *http.Request) {
-	if !handler.authorizeEndpointManagement {
-		Error(w, ErrEndpointManagementDisabled, http.StatusServiceUnavailable, handler.Logger)
-		return
-	}
-
-	vars := mux.Vars(r)
-	id := vars["id"]
-
-	endpointID, err := strconv.Atoi(id)
-	if err != nil {
-		Error(w, err, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	endpoint, err := handler.EndpointService.Endpoint(portainer.EndpointID(endpointID))
-
-	if err == portainer.ErrEndpointNotFound {
-		Error(w, err, http.StatusNotFound, handler.Logger)
-		return
-	} else if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-
-	err = handler.EndpointService.DeleteEndpoint(portainer.EndpointID(endpointID))
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-
-	if endpoint.TLS {
-		err = handler.FileService.DeleteTLSFiles(portainer.EndpointID(endpointID))
-		if err != nil {
-			Error(w, err, http.StatusInternalServerError, handler.Logger)
-		}
-	}
-}
@@ -0,0 +1,22 @@
+package error
+
+import (
+	"encoding/json"
+	"log"
+	"net/http"
+)
+
+// errorResponse is a generic response for sending a error.
+type errorResponse struct {
+	Err string `json:"err,omitempty"`
+}
+
+// WriteErrorResponse writes an error message to the response and logger.
+func WriteErrorResponse(w http.ResponseWriter, err error, code int, logger *log.Logger) {
+	if logger != nil {
+		logger.Printf("http error: %s (code=%d)", err, code)
+	}
+
+	w.WriteHeader(code)
+	json.NewEncoder(w).Encode(&errorResponse{Err: err.Error()})
+}
@@ -1,36 +0,0 @@
-package http
-
-import (
-	"net/http"
-	"strings"
-)
-
-// FileHandler represents an HTTP API handler for managing static files.
-type FileHandler struct {
-	http.Handler
-}
-
-func newFileHandler(assetPath string) *FileHandler {
-	h := &FileHandler{
-		Handler: http.FileServer(http.Dir(assetPath)),
-	}
-	return h
-}
-
-func isHTML(acceptContent []string) bool {
-	for _, accept := range acceptContent {
-		if strings.Contains(accept, "text/html") {
-			return true
-		}
-	}
-	return false
-}
-
-func (fileHandler *FileHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	if !isHTML(r.Header["Accept"]) {
-		w.Header().Set("Cache-Control", "max-age=31536000")
-	} else {
-		w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
-	}
-	fileHandler.Handler.ServeHTTP(w, r)
-}
@@ -1,88 +0,0 @@
-package http
-
-import (
-	"github.com/portainer/portainer"
-
-	"encoding/json"
-	"log"
-	"net/http"
-	"strings"
-)
-
-// Handler is a collection of all the service handlers.
-type Handler struct {
-	AuthHandler      *AuthHandler
-	UserHandler      *UserHandler
-	EndpointHandler  *EndpointHandler
-	SettingsHandler  *SettingsHandler
-	TemplatesHandler *TemplatesHandler
-	DockerHandler    *DockerHandler
-	WebSocketHandler *WebSocketHandler
-	UploadHandler    *UploadHandler
-	FileHandler      *FileHandler
-}
-
-const (
-	// ErrInvalidJSON defines an error raised the app is unable to parse request data
-	ErrInvalidJSON = portainer.Error("Invalid JSON")
-	// ErrInvalidRequestFormat defines an error raised when the format of the data sent in a request is not valid
-	ErrInvalidRequestFormat = portainer.Error("Invalid request data format")
-	// ErrInvalidQueryFormat defines an error raised when the data sent in the query or the URL is invalid
-	ErrInvalidQueryFormat = portainer.Error("Invalid query format")
-	// ErrEmptyResponseBody defines an error raised when portainer excepts to parse the body of a HTTP response and there is nothing to parse
-	ErrEmptyResponseBody = portainer.Error("Empty response body")
-)
-
-// ServeHTTP delegates a request to the appropriate subhandler.
-func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	if strings.HasPrefix(r.URL.Path, "/api/auth") {
-		http.StripPrefix("/api", h.AuthHandler).ServeHTTP(w, r)
-	} else if strings.HasPrefix(r.URL.Path, "/api/users") {
-		http.StripPrefix("/api", h.UserHandler).ServeHTTP(w, r)
-	} else if strings.HasPrefix(r.URL.Path, "/api/endpoints") {
-		http.StripPrefix("/api", h.EndpointHandler).ServeHTTP(w, r)
-	} else if strings.HasPrefix(r.URL.Path, "/api/settings") {
-		http.StripPrefix("/api", h.SettingsHandler).ServeHTTP(w, r)
-	} else if strings.HasPrefix(r.URL.Path, "/api/templates") {
-		http.StripPrefix("/api", h.TemplatesHandler).ServeHTTP(w, r)
-	} else if strings.HasPrefix(r.URL.Path, "/api/upload") {
-		http.StripPrefix("/api", h.UploadHandler).ServeHTTP(w, r)
-	} else if strings.HasPrefix(r.URL.Path, "/api/websocket") {
-		http.StripPrefix("/api", h.WebSocketHandler).ServeHTTP(w, r)
-	} else if strings.HasPrefix(r.URL.Path, "/api/docker") {
-		http.StripPrefix("/api/docker", h.DockerHandler).ServeHTTP(w, r)
-	} else if strings.HasPrefix(r.URL.Path, "/") {
-		h.FileHandler.ServeHTTP(w, r)
-	}
-}
-
-// Error writes an API error message to the response and logger.
-func Error(w http.ResponseWriter, err error, code int, logger *log.Logger) {
-	// Log error.
-	if logger != nil {
-		logger.Printf("http error: %s (code=%d)", err, code)
-	}
-
-	// Write generic error response.
-	w.WriteHeader(code)
-	json.NewEncoder(w).Encode(&errorResponse{Err: err.Error()})
-}
-
-// errorResponse is a generic response for sending a error.
-type errorResponse struct {
-	Err string `json:"err,omitempty"`
-}
-
-// handleNotAllowed writes an API error message to the response and sets the Allow header.
-func handleNotAllowed(w http.ResponseWriter, allowedMethods []string) {
-	w.Header().Set("Allow", strings.Join(allowedMethods, ", "))
-	w.WriteHeader(http.StatusMethodNotAllowed)
-	json.NewEncoder(w).Encode(&errorResponse{Err: http.StatusText(http.StatusMethodNotAllowed)})
-}
-
-// encodeJSON encodes v to w in JSON format. Error() is called if encoding fails.
-func encodeJSON(w http.ResponseWriter, v interface{}, logger *log.Logger) {
-	if err := json.NewEncoder(w).Encode(v); err != nil {
-		Error(w, err, http.StatusInternalServerError, logger)
-	}
-}
@@ -0,0 +1,126 @@
+package handler
+
+import (
+	"github.com/portainer/portainer"
+
+	"encoding/json"
+	"log"
+	"net/http"
+	"os"
+
+	"github.com/asaskevich/govalidator"
+	"github.com/gorilla/mux"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/security"
+)
+
+// AuthHandler represents an HTTP API handler for managing authentication.
+type AuthHandler struct {
+	*mux.Router
+	Logger          *log.Logger
+	authDisabled    bool
+	UserService     portainer.UserService
+	CryptoService   portainer.CryptoService
+	JWTService      portainer.JWTService
+	LDAPService     portainer.LDAPService
+	SettingsService portainer.SettingsService
+}
+
+const (
+	// ErrInvalidCredentialsFormat is an error raised when credentials format is not valid
+	ErrInvalidCredentialsFormat = portainer.Error("Invalid credentials format")
+	// ErrInvalidCredentials is an error raised when credentials for a user are invalid
+	ErrInvalidCredentials = portainer.Error("Invalid credentials")
+	// ErrAuthDisabled is an error raised when trying to access the authentication endpoints
+	// when the server has been started with the --no-auth flag
+	ErrAuthDisabled = portainer.Error("Authentication is disabled")
+)
+
+// NewAuthHandler returns a new instance of AuthHandler.
+func NewAuthHandler(bouncer *security.RequestBouncer, authDisabled bool) *AuthHandler {
+	h := &AuthHandler{
+		Router:       mux.NewRouter(),
+		Logger:       log.New(os.Stderr, "", log.LstdFlags),
+		authDisabled: authDisabled,
+	}
+	h.Handle("/auth",
+		bouncer.PublicAccess(http.HandlerFunc(h.handlePostAuth))).Methods(http.MethodPost)
+
+	return h
+}
+
+type (
+	postAuthRequest struct {
+		Username string `valid:"required"`
+		Password string `valid:"required"`
+	}
+
+	postAuthResponse struct {
+		JWT string `json:"jwt"`
+	}
+)
+
+func (handler *AuthHandler) handlePostAuth(w http.ResponseWriter, r *http.Request) {
+	if handler.authDisabled {
+		httperror.WriteErrorResponse(w, ErrAuthDisabled, http.StatusServiceUnavailable, handler.Logger)
+		return
+	}
+
+	var req postAuthRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err := govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidCredentialsFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var username = req.Username
+	var password = req.Password
+
+	u, err := handler.UserService.UserByUsername(username)
+	if err == portainer.ErrUserNotFound {
+		httperror.WriteErrorResponse(w, ErrInvalidCredentials, http.StatusBadRequest, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	settings, err := handler.SettingsService.Settings()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if settings.AuthenticationMethod == portainer.AuthenticationLDAP && u.ID != 1 {
+		err = handler.LDAPService.AuthenticateUser(username, password, &settings.LDAPSettings)
+		if err != nil {
+			httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+			return
+		}
+	} else {
+		err = handler.CryptoService.CompareHashAndData(u.Password, password)
+		if err != nil {
+			httperror.WriteErrorResponse(w, ErrInvalidCredentials, http.StatusUnprocessableEntity, handler.Logger)
+			return
+		}
+	}
+
+	tokenData := &portainer.TokenData{
+		ID:       u.ID,
+		Username: u.Username,
+		Role:     u.Role,
+	}
+
+	token, err := handler.JWTService.GenerateToken(tokenData)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, &postAuthResponse{JWT: token}, handler.Logger)
+}
@@ -0,0 +1,94 @@
+package handler
+
+import (
+	"strconv"
+
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/proxy"
+	"github.com/portainer/portainer/http/security"
+
+	"log"
+	"net/http"
+	"os"
+
+	"github.com/gorilla/mux"
+)
+
+// DockerHandler represents an HTTP API handler for proxying requests to the Docker API.
+type DockerHandler struct {
+	*mux.Router
+	Logger                *log.Logger
+	EndpointService       portainer.EndpointService
+	TeamMembershipService portainer.TeamMembershipService
+	ProxyManager          *proxy.Manager
+}
+
+// NewDockerHandler returns a new instance of DockerHandler.
+func NewDockerHandler(bouncer *security.RequestBouncer) *DockerHandler {
+	h := &DockerHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+	}
+	h.PathPrefix("/{id}/docker").Handler(
+		bouncer.AuthenticatedAccess(http.HandlerFunc(h.proxyRequestsToDockerAPI)))
+	return h
+}
+
+func (handler *DockerHandler) checkEndpointAccessControl(endpoint *portainer.Endpoint, userID portainer.UserID) bool {
+	for _, authorizedUserID := range endpoint.AuthorizedUsers {
+		if authorizedUserID == userID {
+			return true
+		}
+	}
+
+	memberships, _ := handler.TeamMembershipService.TeamMembershipsByUserID(userID)
+	for _, authorizedTeamID := range endpoint.AuthorizedTeams {
+		for _, membership := range memberships {
+			if membership.TeamID == authorizedTeamID {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func (handler *DockerHandler) proxyRequestsToDockerAPI(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	parsedID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	endpointID := portainer.EndpointID(parsedID)
+	endpoint, err := handler.EndpointService.Endpoint(endpointID)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	tokenData, err := security.RetrieveTokenData(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	if tokenData.Role != portainer.AdministratorRole && !handler.checkEndpointAccessControl(endpoint, tokenData.ID) {
+		httperror.WriteErrorResponse(w, portainer.ErrEndpointAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	var proxy http.Handler
+	proxy = handler.ProxyManager.GetProxy(string(endpointID))
+	if proxy == nil {
+		proxy, err = handler.ProxyManager.CreateAndRegisterProxy(endpoint)
+		if err != nil {
+			httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+			return
+		}
+	}
+
+	http.StripPrefix("/"+id+"/docker", proxy).ServeHTTP(w, r)
+}
@@ -0,0 +1,89 @@
+package handler
+
+import (
+	"encoding/json"
+
+	"github.com/asaskevich/govalidator"
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/security"
+
+	"log"
+	"net/http"
+	"os"
+
+	"github.com/gorilla/mux"
+)
+
+// DockerHubHandler represents an HTTP API handler for managing DockerHub.
+type DockerHubHandler struct {
+	*mux.Router
+	Logger           *log.Logger
+	DockerHubService portainer.DockerHubService
+}
+
+// NewDockerHubHandler returns a new instance of NewDockerHubHandler.
+func NewDockerHubHandler(bouncer *security.RequestBouncer) *DockerHubHandler {
+	h := &DockerHubHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+	}
+	h.Handle("/dockerhub",
+		bouncer.AuthenticatedAccess(http.HandlerFunc(h.handleGetDockerHub))).Methods(http.MethodGet)
+	h.Handle("/dockerhub",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePutDockerHub))).Methods(http.MethodPut)
+
+	return h
+}
+
+type (
+	putDockerHubRequest struct {
+		Authentication bool   `valid:""`
+		Username       string `valid:""`
+		Password       string `valid:""`
+	}
+)
+
+// handleGetDockerHub handles GET requests on /dockerhub
+func (handler *DockerHubHandler) handleGetDockerHub(w http.ResponseWriter, r *http.Request) {
+	dockerhub, err := handler.DockerHubService.DockerHub()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, dockerhub, handler.Logger)
+	return
+}
+
+// handlePutDockerHub handles PUT requests on /dockerhub
+func (handler *DockerHubHandler) handlePutDockerHub(w http.ResponseWriter, r *http.Request) {
+	var req putDockerHubRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err := govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	dockerhub := &portainer.DockerHub{
+		Authentication: false,
+		Username:       "",
+		Password:       "",
+	}
+
+	if req.Authentication {
+		dockerhub.Authentication = true
+		dockerhub.Username = req.Username
+		dockerhub.Password = req.Password
+	}
+
+	err = handler.DockerHubService.StoreDockerHub(dockerhub)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+	}
+}
@@ -0,0 +1,389 @@
+package handler
+
+import (
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/proxy"
+	"github.com/portainer/portainer/http/security"
+
+	"encoding/json"
+	"log"
+	"net/http"
+	"os"
+	"strconv"
+
+	"github.com/asaskevich/govalidator"
+	"github.com/gorilla/mux"
+)
+
+// EndpointHandler represents an HTTP API handler for managing Docker endpoints.
+type EndpointHandler struct {
+	*mux.Router
+	Logger                      *log.Logger
+	authorizeEndpointManagement bool
+	EndpointService             portainer.EndpointService
+	FileService                 portainer.FileService
+	ProxyManager                *proxy.Manager
+}
+
+const (
+	// ErrEndpointManagementDisabled is an error raised when trying to access the endpoints management endpoints
+	// when the server has been started with the --external-endpoints flag
+	ErrEndpointManagementDisabled = portainer.Error("Endpoint management is disabled")
+)
+
+// NewEndpointHandler returns a new instance of EndpointHandler.
+func NewEndpointHandler(bouncer *security.RequestBouncer, authorizeEndpointManagement bool) *EndpointHandler {
+	h := &EndpointHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+		authorizeEndpointManagement: authorizeEndpointManagement,
+	}
+	h.Handle("/endpoints",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePostEndpoints))).Methods(http.MethodPost)
+	h.Handle("/endpoints",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleGetEndpoints))).Methods(http.MethodGet)
+	h.Handle("/endpoints/{id}",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handleGetEndpoint))).Methods(http.MethodGet)
+	h.Handle("/endpoints/{id}",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePutEndpoint))).Methods(http.MethodPut)
+	h.Handle("/endpoints/{id}/access",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePutEndpointAccess))).Methods(http.MethodPut)
+	h.Handle("/endpoints/{id}",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handleDeleteEndpoint))).Methods(http.MethodDelete)
+
+	return h
+}
+
+type (
+	postEndpointsRequest struct {
+		Name                string `valid:"required"`
+		URL                 string `valid:"required"`
+		PublicURL           string `valid:"-"`
+		TLS                 bool
+		TLSSkipVerify       bool
+		TLSSkipClientVerify bool
+	}
+
+	postEndpointsResponse struct {
+		ID int `json:"Id"`
+	}
+
+	putEndpointAccessRequest struct {
+		AuthorizedUsers []int `valid:"-"`
+		AuthorizedTeams []int `valid:"-"`
+	}
+
+	putEndpointsRequest struct {
+		Name                string `valid:"-"`
+		URL                 string `valid:"-"`
+		PublicURL           string `valid:"-"`
+		TLS                 bool   `valid:"-"`
+		TLSSkipVerify       bool   `valid:"-"`
+		TLSSkipClientVerify bool   `valid:"-"`
+	}
+)
+
+// handleGetEndpoints handles GET requests on /endpoints
+func (handler *EndpointHandler) handleGetEndpoints(w http.ResponseWriter, r *http.Request) {
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	endpoints, err := handler.EndpointService.Endpoints()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	filteredEndpoints, err := security.FilterEndpoints(endpoints, securityContext)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, filteredEndpoints, handler.Logger)
+}
+
+// handlePostEndpoints handles POST requests on /endpoints
+func (handler *EndpointHandler) handlePostEndpoints(w http.ResponseWriter, r *http.Request) {
+	if !handler.authorizeEndpointManagement {
+		httperror.WriteErrorResponse(w, ErrEndpointManagementDisabled, http.StatusServiceUnavailable, handler.Logger)
+		return
+	}
+
+	var req postEndpointsRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err := govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	endpoint := &portainer.Endpoint{
+		Name:      req.Name,
+		URL:       req.URL,
+		PublicURL: req.PublicURL,
+		TLSConfig: portainer.TLSConfiguration{
+			TLS:           req.TLS,
+			TLSSkipVerify: req.TLSSkipVerify,
+		},
+		AuthorizedUsers: []portainer.UserID{},
+		AuthorizedTeams: []portainer.TeamID{},
+	}
+
+	err = handler.EndpointService.CreateEndpoint(endpoint)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if req.TLS {
+		folder := strconv.Itoa(int(endpoint.ID))
+
+		if !req.TLSSkipVerify {
+			caCertPath, _ := handler.FileService.GetPathForTLSFile(folder, portainer.TLSFileCA)
+			endpoint.TLSConfig.TLSCACertPath = caCertPath
+		}
+
+		if !req.TLSSkipClientVerify {
+			certPath, _ := handler.FileService.GetPathForTLSFile(folder, portainer.TLSFileCert)
+			endpoint.TLSConfig.TLSCertPath = certPath
+			keyPath, _ := handler.FileService.GetPathForTLSFile(folder, portainer.TLSFileKey)
+			endpoint.TLSConfig.TLSKeyPath = keyPath
+		}
+
+		err = handler.EndpointService.UpdateEndpoint(endpoint.ID, endpoint)
+		if err != nil {
+			httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+			return
+		}
+	}
+
+	encodeJSON(w, &postEndpointsResponse{ID: int(endpoint.ID)}, handler.Logger)
+}
+
+// handleGetEndpoint handles GET requests on /endpoints/:id
+func (handler *EndpointHandler) handleGetEndpoint(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	endpointID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	endpoint, err := handler.EndpointService.Endpoint(portainer.EndpointID(endpointID))
+	if err == portainer.ErrEndpointNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, endpoint, handler.Logger)
+}
+
+// handlePutEndpointAccess handles PUT requests on /endpoints/:id/access
+func (handler *EndpointHandler) handlePutEndpointAccess(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	endpointID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var req putEndpointAccessRequest
+	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	endpoint, err := handler.EndpointService.Endpoint(portainer.EndpointID(endpointID))
+	if err == portainer.ErrEndpointNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if req.AuthorizedUsers != nil {
+		authorizedUserIDs := []portainer.UserID{}
+		for _, value := range req.AuthorizedUsers {
+			authorizedUserIDs = append(authorizedUserIDs, portainer.UserID(value))
+		}
+		endpoint.AuthorizedUsers = authorizedUserIDs
+	}
+
+	if req.AuthorizedTeams != nil {
+		authorizedTeamIDs := []portainer.TeamID{}
+		for _, value := range req.AuthorizedTeams {
+			authorizedTeamIDs = append(authorizedTeamIDs, portainer.TeamID(value))
+		}
+		endpoint.AuthorizedTeams = authorizedTeamIDs
+	}
+
+	err = handler.EndpointService.UpdateEndpoint(endpoint.ID, endpoint)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
+
+// handlePutEndpoint handles PUT requests on /endpoints/:id
+func (handler *EndpointHandler) handlePutEndpoint(w http.ResponseWriter, r *http.Request) {
+	if !handler.authorizeEndpointManagement {
+		httperror.WriteErrorResponse(w, ErrEndpointManagementDisabled, http.StatusServiceUnavailable, handler.Logger)
+		return
+	}
+
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	endpointID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var req putEndpointsRequest
+	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	endpoint, err := handler.EndpointService.Endpoint(portainer.EndpointID(endpointID))
+	if err == portainer.ErrEndpointNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if req.Name != "" {
+		endpoint.Name = req.Name
+	}
+
+	if req.URL != "" {
+		endpoint.URL = req.URL
+	}
+
+	if req.PublicURL != "" {
+		endpoint.PublicURL = req.PublicURL
+	}
+
+	folder := strconv.Itoa(int(endpoint.ID))
+	if req.TLS {
+		endpoint.TLSConfig.TLS = true
+		endpoint.TLSConfig.TLSSkipVerify = req.TLSSkipVerify
+		if !req.TLSSkipVerify {
+			caCertPath, _ := handler.FileService.GetPathForTLSFile(folder, portainer.TLSFileCA)
+			endpoint.TLSConfig.TLSCACertPath = caCertPath
+		} else {
+			endpoint.TLSConfig.TLSCACertPath = ""
+			handler.FileService.DeleteTLSFile(folder, portainer.TLSFileCA)
+		}
+
+		if !req.TLSSkipClientVerify {
+			certPath, _ := handler.FileService.GetPathForTLSFile(folder, portainer.TLSFileCert)
+			endpoint.TLSConfig.TLSCertPath = certPath
+			keyPath, _ := handler.FileService.GetPathForTLSFile(folder, portainer.TLSFileKey)
+			endpoint.TLSConfig.TLSKeyPath = keyPath
+		} else {
+			endpoint.TLSConfig.TLSCertPath = ""
+			handler.FileService.DeleteTLSFile(folder, portainer.TLSFileCert)
+			endpoint.TLSConfig.TLSKeyPath = ""
+			handler.FileService.DeleteTLSFile(folder, portainer.TLSFileKey)
+		}
+	} else {
+		endpoint.TLSConfig.TLS = false
+		endpoint.TLSConfig.TLSSkipVerify = true
+		endpoint.TLSConfig.TLSCACertPath = ""
+		endpoint.TLSConfig.TLSCertPath = ""
+		endpoint.TLSConfig.TLSKeyPath = ""
+		err = handler.FileService.DeleteTLSFiles(folder)
+		if err != nil {
+			httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+			return
+		}
+	}
+
+	_, err = handler.ProxyManager.CreateAndRegisterProxy(endpoint)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	err = handler.EndpointService.UpdateEndpoint(endpoint.ID, endpoint)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
+
+// handleDeleteEndpoint handles DELETE requests on /endpoints/:id
+func (handler *EndpointHandler) handleDeleteEndpoint(w http.ResponseWriter, r *http.Request) {
+	if !handler.authorizeEndpointManagement {
+		httperror.WriteErrorResponse(w, ErrEndpointManagementDisabled, http.StatusServiceUnavailable, handler.Logger)
+		return
+	}
+
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	endpointID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	endpoint, err := handler.EndpointService.Endpoint(portainer.EndpointID(endpointID))
+
+	if err == portainer.ErrEndpointNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	handler.ProxyManager.DeleteProxy(string(endpointID))
+
+	err = handler.EndpointService.DeleteEndpoint(portainer.EndpointID(endpointID))
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if endpoint.TLSConfig.TLS {
+		err = handler.FileService.DeleteTLSFiles(id)
+		if err != nil {
+			httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+			return
+		}
+	}
+}
@@ -0,0 +1,62 @@
+package handler
+
+import (
+	"os"
+
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+
+	"log"
+	"net/http"
+	"path"
+	"strings"
+)
+
+// FileHandler represents an HTTP API handler for managing static files.
+type FileHandler struct {
+	http.Handler
+	Logger             *log.Logger
+	allowedDirectories map[string]bool
+}
+
+// NewFileHandler returns a new instance of FileHandler.
+func NewFileHandler(assetPath string) *FileHandler {
+	h := &FileHandler{
+		Handler: http.FileServer(http.Dir(assetPath)),
+		Logger:  log.New(os.Stderr, "", log.LstdFlags),
+		allowedDirectories: map[string]bool{
+			"/":       true,
+			"/css":    true,
+			"/js":     true,
+			"/images": true,
+			"/fonts":  true,
+			"/ico":    true,
+		},
+	}
+	return h
+}
+
+func isHTML(acceptContent []string) bool {
+	for _, accept := range acceptContent {
+		if strings.Contains(accept, "text/html") {
+			return true
+		}
+	}
+	return false
+}
+
+func (handler *FileHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	requestDirectory := path.Dir(r.URL.Path)
+	if !handler.allowedDirectories[requestDirectory] {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceNotFound, http.StatusNotFound, handler.Logger)
+		return
+	}
+
+	if !isHTML(r.Header["Accept"]) {
+		w.Header().Set("Cache-Control", "max-age=31536000")
+	} else {
+		w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
+	}
+
+	handler.Handler.ServeHTTP(w, r)
+}
@@ -0,0 +1,85 @@
+package handler
+
+import (
+	"encoding/json"
+	"log"
+	"net/http"
+	"strings"
+
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+)
+
+// Handler is a collection of all the service handlers.
+type Handler struct {
+	AuthHandler           *AuthHandler
+	UserHandler           *UserHandler
+	TeamHandler           *TeamHandler
+	TeamMembershipHandler *TeamMembershipHandler
+	EndpointHandler       *EndpointHandler
+	RegistryHandler       *RegistryHandler
+	DockerHubHandler      *DockerHubHandler
+	ResourceHandler       *ResourceHandler
+	StatusHandler         *StatusHandler
+	SettingsHandler       *SettingsHandler
+	TemplatesHandler      *TemplatesHandler
+	DockerHandler         *DockerHandler
+	WebSocketHandler      *WebSocketHandler
+	UploadHandler         *UploadHandler
+	FileHandler           *FileHandler
+}
+
+const (
+	// ErrInvalidJSON defines an error raised the app is unable to parse request data
+	ErrInvalidJSON = portainer.Error("Invalid JSON")
+	// ErrInvalidRequestFormat defines an error raised when the format of the data sent in a request is not valid
+	ErrInvalidRequestFormat = portainer.Error("Invalid request data format")
+	// ErrInvalidQueryFormat defines an error raised when the data sent in the query or the URL is invalid
+	ErrInvalidQueryFormat = portainer.Error("Invalid query format")
+)
+
+// ServeHTTP delegates a request to the appropriate subhandler.
+func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+
+	switch {
+	case strings.HasPrefix(r.URL.Path, "/api/auth"):
+		http.StripPrefix("/api", h.AuthHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/dockerhub"):
+		http.StripPrefix("/api", h.DockerHubHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/endpoints"):
+		if strings.Contains(r.URL.Path, "/docker") {
+			http.StripPrefix("/api/endpoints", h.DockerHandler).ServeHTTP(w, r)
+		} else {
+			http.StripPrefix("/api", h.EndpointHandler).ServeHTTP(w, r)
+		}
+	case strings.HasPrefix(r.URL.Path, "/api/registries"):
+		http.StripPrefix("/api", h.RegistryHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/resource_controls"):
+		http.StripPrefix("/api", h.ResourceHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/settings"):
+		http.StripPrefix("/api", h.SettingsHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/status"):
+		http.StripPrefix("/api", h.StatusHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/templates"):
+		http.StripPrefix("/api", h.TemplatesHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/upload"):
+		http.StripPrefix("/api", h.UploadHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/users"):
+		http.StripPrefix("/api", h.UserHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/teams"):
+		http.StripPrefix("/api", h.TeamHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/team_memberships"):
+		http.StripPrefix("/api", h.TeamMembershipHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/websocket"):
+		http.StripPrefix("/api", h.WebSocketHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/"):
+		h.FileHandler.ServeHTTP(w, r)
+	}
+}
+
+// encodeJSON encodes v to w in JSON format. WriteErrorResponse() is called if encoding fails.
+func encodeJSON(w http.ResponseWriter, v interface{}, logger *log.Logger) {
+	if err := json.NewEncoder(w).Encode(v); err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, logger)
+	}
+}
@@ -0,0 +1,314 @@
+package handler
+
+import (
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/security"
+
+	"encoding/json"
+	"log"
+	"net/http"
+	"os"
+	"strconv"
+
+	"github.com/asaskevich/govalidator"
+	"github.com/gorilla/mux"
+)
+
+// RegistryHandler represents an HTTP API handler for managing Docker registries.
+type RegistryHandler struct {
+	*mux.Router
+	Logger          *log.Logger
+	RegistryService portainer.RegistryService
+}
+
+// NewRegistryHandler returns a new instance of RegistryHandler.
+func NewRegistryHandler(bouncer *security.RequestBouncer) *RegistryHandler {
+	h := &RegistryHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+	}
+	h.Handle("/registries",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePostRegistries))).Methods(http.MethodPost)
+	h.Handle("/registries",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleGetRegistries))).Methods(http.MethodGet)
+	h.Handle("/registries/{id}",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handleGetRegistry))).Methods(http.MethodGet)
+	h.Handle("/registries/{id}",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePutRegistry))).Methods(http.MethodPut)
+	h.Handle("/registries/{id}/access",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePutRegistryAccess))).Methods(http.MethodPut)
+	h.Handle("/registries/{id}",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handleDeleteRegistry))).Methods(http.MethodDelete)
+
+	return h
+}
+
+type (
+	postRegistriesRequest struct {
+		Name           string `valid:"required"`
+		URL            string `valid:"required"`
+		Authentication bool   `valid:""`
+		Username       string `valid:""`
+		Password       string `valid:""`
+	}
+
+	postRegistriesResponse struct {
+		ID int `json:"Id"`
+	}
+
+	putRegistryAccessRequest struct {
+		AuthorizedUsers []int `valid:"-"`
+		AuthorizedTeams []int `valid:"-"`
+	}
+
+	putRegistriesRequest struct {
+		Name           string `valid:"required"`
+		URL            string `valid:"required"`
+		Authentication bool   `valid:""`
+		Username       string `valid:""`
+		Password       string `valid:""`
+	}
+)
+
+// handleGetRegistries handles GET requests on /registries
+func (handler *RegistryHandler) handleGetRegistries(w http.ResponseWriter, r *http.Request) {
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	registries, err := handler.RegistryService.Registries()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	filteredRegistries, err := security.FilterRegistries(registries, securityContext)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, filteredRegistries, handler.Logger)
+}
+
+// handlePostRegistries handles POST requests on /registries
+func (handler *RegistryHandler) handlePostRegistries(w http.ResponseWriter, r *http.Request) {
+	var req postRegistriesRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err := govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	registries, err := handler.RegistryService.Registries()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	for _, r := range registries {
+		if r.URL == req.URL {
+			httperror.WriteErrorResponse(w, portainer.ErrRegistryAlreadyExists, http.StatusConflict, handler.Logger)
+			return
+		}
+	}
+
+	registry := &portainer.Registry{
+		Name:            req.Name,
+		URL:             req.URL,
+		Authentication:  req.Authentication,
+		Username:        req.Username,
+		Password:        req.Password,
+		AuthorizedUsers: []portainer.UserID{},
+		AuthorizedTeams: []portainer.TeamID{},
+	}
+
+	err = handler.RegistryService.CreateRegistry(registry)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, &postRegistriesResponse{ID: int(registry.ID)}, handler.Logger)
+}
+
+// handleGetRegistry handles GET requests on /registries/:id
+func (handler *RegistryHandler) handleGetRegistry(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	registryID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	registry, err := handler.RegistryService.Registry(portainer.RegistryID(registryID))
+	if err == portainer.ErrRegistryNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, registry, handler.Logger)
+}
+
+// handlePutRegistryAccess handles PUT requests on /registries/:id/access
+func (handler *RegistryHandler) handlePutRegistryAccess(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	registryID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var req putRegistryAccessRequest
+	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	registry, err := handler.RegistryService.Registry(portainer.RegistryID(registryID))
+	if err == portainer.ErrRegistryNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if req.AuthorizedUsers != nil {
+		authorizedUserIDs := []portainer.UserID{}
+		for _, value := range req.AuthorizedUsers {
+			authorizedUserIDs = append(authorizedUserIDs, portainer.UserID(value))
+		}
+		registry.AuthorizedUsers = authorizedUserIDs
+	}
+
+	if req.AuthorizedTeams != nil {
+		authorizedTeamIDs := []portainer.TeamID{}
+		for _, value := range req.AuthorizedTeams {
+			authorizedTeamIDs = append(authorizedTeamIDs, portainer.TeamID(value))
+		}
+		registry.AuthorizedTeams = authorizedTeamIDs
+	}
+
+	err = handler.RegistryService.UpdateRegistry(registry.ID, registry)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
+
+// handlePutRegistry handles PUT requests on /registries/:id
+func (handler *RegistryHandler) handlePutRegistry(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	registryID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var req putRegistriesRequest
+	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	registry, err := handler.RegistryService.Registry(portainer.RegistryID(registryID))
+	if err == portainer.ErrRegistryNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	registries, err := handler.RegistryService.Registries()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	for _, r := range registries {
+		if r.URL == req.URL && r.ID != registry.ID {
+			httperror.WriteErrorResponse(w, portainer.ErrRegistryAlreadyExists, http.StatusConflict, handler.Logger)
+			return
+		}
+	}
+
+	if req.Name != "" {
+		registry.Name = req.Name
+	}
+
+	if req.URL != "" {
+		registry.URL = req.URL
+	}
+
+	if req.Authentication {
+		registry.Authentication = true
+		registry.Username = req.Username
+		registry.Password = req.Password
+	} else {
+		registry.Authentication = false
+		registry.Username = ""
+		registry.Password = ""
+	}
+
+	err = handler.RegistryService.UpdateRegistry(registry.ID, registry)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
+
+// handleDeleteRegistry handles DELETE requests on /registries/:id
+func (handler *RegistryHandler) handleDeleteRegistry(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	registryID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = handler.RegistryService.Registry(portainer.RegistryID(registryID))
+	if err == portainer.ErrRegistryNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	err = handler.RegistryService.DeleteRegistry(portainer.RegistryID(registryID))
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
@@ -0,0 +1,262 @@
+package handler
+
+import (
+	"encoding/json"
+	"strconv"
+
+	"github.com/asaskevich/govalidator"
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/security"
+
+	"log"
+	"net/http"
+	"os"
+
+	"github.com/gorilla/mux"
+)
+
+// ResourceHandler represents an HTTP API handler for managing resource controls.
+type ResourceHandler struct {
+	*mux.Router
+	Logger                 *log.Logger
+	ResourceControlService portainer.ResourceControlService
+}
+
+// NewResourceHandler returns a new instance of ResourceHandler.
+func NewResourceHandler(bouncer *security.RequestBouncer) *ResourceHandler {
+	h := &ResourceHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+	}
+	h.Handle("/resource_controls",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handlePostResources))).Methods(http.MethodPost)
+	h.Handle("/resource_controls/{id}",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handlePutResources))).Methods(http.MethodPut)
+	h.Handle("/resource_controls/{id}",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleDeleteResources))).Methods(http.MethodDelete)
+
+	return h
+}
+
+type (
+	postResourcesRequest struct {
+		ResourceID         string   `valid:"required"`
+		Type               string   `valid:"required"`
+		AdministratorsOnly bool     `valid:"-"`
+		Users              []int    `valid:"-"`
+		Teams              []int    `valid:"-"`
+		SubResourceIDs     []string `valid:"-"`
+	}
+
+	putResourcesRequest struct {
+		AdministratorsOnly bool  `valid:"-"`
+		Users              []int `valid:"-"`
+		Teams              []int `valid:"-"`
+	}
+)
+
+// handlePostResources handles POST requests on /resources
+func (handler *ResourceHandler) handlePostResources(w http.ResponseWriter, r *http.Request) {
+	var req postResourcesRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err := govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var resourceControlType portainer.ResourceControlType
+	switch req.Type {
+	case "container":
+		resourceControlType = portainer.ContainerResourceControl
+	case "service":
+		resourceControlType = portainer.ServiceResourceControl
+	case "volume":
+		resourceControlType = portainer.VolumeResourceControl
+	case "network":
+		resourceControlType = portainer.NetworkResourceControl
+	case "secret":
+		resourceControlType = portainer.SecretResourceControl
+	default:
+		httperror.WriteErrorResponse(w, portainer.ErrInvalidResourceControlType, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	if len(req.Users) == 0 && len(req.Teams) == 0 && !req.AdministratorsOnly {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	rc, err := handler.ResourceControlService.ResourceControlByResourceID(req.ResourceID)
+	if err != nil && err != portainer.ErrResourceControlNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	if rc != nil {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceControlAlreadyExists, http.StatusConflict, handler.Logger)
+		return
+	}
+
+	var userAccesses = make([]portainer.UserResourceAccess, 0)
+	for _, v := range req.Users {
+		userAccess := portainer.UserResourceAccess{
+			UserID:      portainer.UserID(v),
+			AccessLevel: portainer.ReadWriteAccessLevel,
+		}
+		userAccesses = append(userAccesses, userAccess)
+	}
+
+	var teamAccesses = make([]portainer.TeamResourceAccess, 0)
+	for _, v := range req.Teams {
+		teamAccess := portainer.TeamResourceAccess{
+			TeamID:      portainer.TeamID(v),
+			AccessLevel: portainer.ReadWriteAccessLevel,
+		}
+		teamAccesses = append(teamAccesses, teamAccess)
+	}
+
+	resourceControl := portainer.ResourceControl{
+		ResourceID:         req.ResourceID,
+		SubResourceIDs:     req.SubResourceIDs,
+		Type:               resourceControlType,
+		AdministratorsOnly: req.AdministratorsOnly,
+		UserAccesses:       userAccesses,
+		TeamAccesses:       teamAccesses,
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if !security.AuthorizedResourceControlCreation(&resourceControl, securityContext) {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	err = handler.ResourceControlService.CreateResourceControl(&resourceControl)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	return
+}
+
+// handlePutResources handles PUT requests on /resources/:id
+func (handler *ResourceHandler) handlePutResources(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	resourceControlID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var req putResourcesRequest
+	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	resourceControl, err := handler.ResourceControlService.ResourceControl(portainer.ResourceControlID(resourceControlID))
+
+	if err == portainer.ErrResourceControlNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	resourceControl.AdministratorsOnly = req.AdministratorsOnly
+
+	var userAccesses = make([]portainer.UserResourceAccess, 0)
+	for _, v := range req.Users {
+		userAccess := portainer.UserResourceAccess{
+			UserID:      portainer.UserID(v),
+			AccessLevel: portainer.ReadWriteAccessLevel,
+		}
+		userAccesses = append(userAccesses, userAccess)
+	}
+	resourceControl.UserAccesses = userAccesses
+
+	var teamAccesses = make([]portainer.TeamResourceAccess, 0)
+	for _, v := range req.Teams {
+		teamAccess := portainer.TeamResourceAccess{
+			TeamID:      portainer.TeamID(v),
+			AccessLevel: portainer.ReadWriteAccessLevel,
+		}
+		teamAccesses = append(teamAccesses, teamAccess)
+	}
+	resourceControl.TeamAccesses = teamAccesses
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if !security.AuthorizedResourceControlUpdate(resourceControl, securityContext) {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	err = handler.ResourceControlService.UpdateResourceControl(resourceControl.ID, resourceControl)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
+
+// handleDeleteResources handles DELETE requests on /resources/:id
+func (handler *ResourceHandler) handleDeleteResources(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	resourceControlID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	resourceControl, err := handler.ResourceControlService.ResourceControl(portainer.ResourceControlID(resourceControlID))
+
+	if err == portainer.ErrResourceControlNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if !security.AuthorizedResourceControlDeletion(resourceControl, securityContext) {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	err = handler.ResourceControlService.DeleteResourceControl(portainer.ResourceControlID(resourceControlID))
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
@@ -0,0 +1,169 @@
+package handler
+
+import (
+	"encoding/json"
+
+	"github.com/asaskevich/govalidator"
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/file"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/security"
+
+	"log"
+	"net/http"
+	"os"
+
+	"github.com/gorilla/mux"
+)
+
+// SettingsHandler represents an HTTP API handler for managing Settings.
+type SettingsHandler struct {
+	*mux.Router
+	Logger          *log.Logger
+	SettingsService portainer.SettingsService
+	LDAPService     portainer.LDAPService
+	FileService     portainer.FileService
+}
+
+// NewSettingsHandler returns a new instance of OldSettingsHandler.
+func NewSettingsHandler(bouncer *security.RequestBouncer) *SettingsHandler {
+	h := &SettingsHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+	}
+	h.Handle("/settings",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handleGetSettings))).Methods(http.MethodGet)
+	h.Handle("/settings",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePutSettings))).Methods(http.MethodPut)
+	h.Handle("/settings/public",
+		bouncer.PublicAccess(http.HandlerFunc(h.handleGetPublicSettings))).Methods(http.MethodGet)
+	h.Handle("/settings/authentication/checkLDAP",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePutSettingsLDAPCheck))).Methods(http.MethodPut)
+
+	return h
+}
+
+type (
+	publicSettingsResponse struct {
+		LogoURL                     string                         `json:"LogoURL"`
+		DisplayExternalContributors bool                           `json:"DisplayExternalContributors"`
+		AuthenticationMethod        portainer.AuthenticationMethod `json:"AuthenticationMethod"`
+	}
+
+	putSettingsRequest struct {
+		TemplatesURL                string                 `valid:"required"`
+		LogoURL                     string                 `valid:""`
+		BlackListedLabels           []portainer.Pair       `valid:""`
+		DisplayExternalContributors bool                   `valid:""`
+		AuthenticationMethod        int                    `valid:"required"`
+		LDAPSettings                portainer.LDAPSettings `valid:""`
+	}
+
+	putSettingsLDAPCheckRequest struct {
+		LDAPSettings portainer.LDAPSettings `valid:""`
+	}
+)
+
+// handleGetSettings handles GET requests on /settings
+func (handler *SettingsHandler) handleGetSettings(w http.ResponseWriter, r *http.Request) {
+	settings, err := handler.SettingsService.Settings()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, settings, handler.Logger)
+	return
+}
+
+// handleGetPublicSettings handles GET requests on /settings/public
+func (handler *SettingsHandler) handleGetPublicSettings(w http.ResponseWriter, r *http.Request) {
+	settings, err := handler.SettingsService.Settings()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	publicSettings := &publicSettingsResponse{
+		LogoURL:                     settings.LogoURL,
+		DisplayExternalContributors: settings.DisplayExternalContributors,
+		AuthenticationMethod:        settings.AuthenticationMethod,
+	}
+
+	encodeJSON(w, publicSettings, handler.Logger)
+	return
+}
+
+// handlePutSettings handles PUT requests on /settings
+func (handler *SettingsHandler) handlePutSettings(w http.ResponseWriter, r *http.Request) {
+	var req putSettingsRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err := govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	settings := &portainer.Settings{
+		TemplatesURL:                req.TemplatesURL,
+		LogoURL:                     req.LogoURL,
+		BlackListedLabels:           req.BlackListedLabels,
+		DisplayExternalContributors: req.DisplayExternalContributors,
+		LDAPSettings:                req.LDAPSettings,
+	}
+
+	if req.AuthenticationMethod == 1 {
+		settings.AuthenticationMethod = portainer.AuthenticationInternal
+	} else if req.AuthenticationMethod == 2 {
+		settings.AuthenticationMethod = portainer.AuthenticationLDAP
+	} else {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	if (settings.LDAPSettings.TLSConfig.TLS || settings.LDAPSettings.StartTLS) && !settings.LDAPSettings.TLSConfig.TLSSkipVerify {
+		caCertPath, _ := handler.FileService.GetPathForTLSFile(file.LDAPStorePath, portainer.TLSFileCA)
+		settings.LDAPSettings.TLSConfig.TLSCACertPath = caCertPath
+	} else {
+		settings.LDAPSettings.TLSConfig.TLSCACertPath = ""
+		err := handler.FileService.DeleteTLSFiles(file.LDAPStorePath)
+		if err != nil {
+			httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		}
+	}
+
+	err = handler.SettingsService.StoreSettings(settings)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+	}
+}
+
+// handlePutSettingsLDAPCheck handles PUT requests on /settings/ldap/check
+func (handler *SettingsHandler) handlePutSettingsLDAPCheck(w http.ResponseWriter, r *http.Request) {
+	var req putSettingsLDAPCheckRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err := govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	if (req.LDAPSettings.TLSConfig.TLS || req.LDAPSettings.StartTLS) && !req.LDAPSettings.TLSConfig.TLSSkipVerify {
+		caCertPath, _ := handler.FileService.GetPathForTLSFile(file.LDAPStorePath, portainer.TLSFileCA)
+		req.LDAPSettings.TLSConfig.TLSCACertPath = caCertPath
+	}
+
+	err = handler.LDAPService.TestConnectivity(&req.LDAPSettings)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
@@ -0,0 +1,38 @@
+package handler
+
+import (
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/http/security"
+
+	"log"
+	"net/http"
+	"os"
+
+	"github.com/gorilla/mux"
+)
+
+// StatusHandler represents an HTTP API handler for managing Status.
+type StatusHandler struct {
+	*mux.Router
+	Logger *log.Logger
+	Status *portainer.Status
+}
+
+// NewStatusHandler returns a new instance of StatusHandler.
+func NewStatusHandler(bouncer *security.RequestBouncer, status *portainer.Status) *StatusHandler {
+	h := &StatusHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+		Status: status,
+	}
+	h.Handle("/status",
+		bouncer.PublicAccess(http.HandlerFunc(h.handleGetStatus))).Methods(http.MethodGet)
+
+	return h
+}
+
+// handleGetStatus handles GET requests on /status
+func (handler *StatusHandler) handleGetStatus(w http.ResponseWriter, r *http.Request) {
+	encodeJSON(w, handler.Status, handler.Logger)
+	return
+}
@@ -0,0 +1,262 @@
+package handler
+
+import (
+	"strconv"
+
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/security"
+
+	"encoding/json"
+	"log"
+	"net/http"
+	"os"
+
+	"github.com/asaskevich/govalidator"
+	"github.com/gorilla/mux"
+)
+
+// TeamHandler represents an HTTP API handler for managing teams.
+type TeamHandler struct {
+	*mux.Router
+	Logger                 *log.Logger
+	TeamService            portainer.TeamService
+	TeamMembershipService  portainer.TeamMembershipService
+	ResourceControlService portainer.ResourceControlService
+}
+
+// NewTeamHandler returns a new instance of TeamHandler.
+func NewTeamHandler(bouncer *security.RequestBouncer) *TeamHandler {
+	h := &TeamHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+	}
+	h.Handle("/teams",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePostTeams))).Methods(http.MethodPost)
+	h.Handle("/teams",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleGetTeams))).Methods(http.MethodGet)
+	h.Handle("/teams/{id}",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleGetTeam))).Methods(http.MethodGet)
+	h.Handle("/teams/{id}",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePutTeam))).Methods(http.MethodPut)
+	h.Handle("/teams/{id}",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handleDeleteTeam))).Methods(http.MethodDelete)
+	h.Handle("/teams/{id}/memberships",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleGetMemberships))).Methods(http.MethodGet)
+
+	return h
+}
+
+type (
+	postTeamsRequest struct {
+		Name string `valid:"required"`
+	}
+
+	postTeamsResponse struct {
+		ID int `json:"Id"`
+	}
+
+	putTeamRequest struct {
+		Name string `valid:"-"`
+	}
+)
+
+// handlePostTeams handles POST requests on /teams
+func (handler *TeamHandler) handlePostTeams(w http.ResponseWriter, r *http.Request) {
+	var req postTeamsRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err := govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	team, err := handler.TeamService.TeamByName(req.Name)
+	if err != nil && err != portainer.ErrTeamNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	if team != nil {
+		httperror.WriteErrorResponse(w, portainer.ErrTeamAlreadyExists, http.StatusConflict, handler.Logger)
+		return
+	}
+
+	team = &portainer.Team{
+		Name: req.Name,
+	}
+
+	err = handler.TeamService.CreateTeam(team)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, &postTeamsResponse{ID: int(team.ID)}, handler.Logger)
+}
+
+// handleGetTeams handles GET requests on /teams
+func (handler *TeamHandler) handleGetTeams(w http.ResponseWriter, r *http.Request) {
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	teams, err := handler.TeamService.Teams()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	filteredTeams := security.FilterUserTeams(teams, securityContext)
+
+	encodeJSON(w, filteredTeams, handler.Logger)
+}
+
+// handleGetTeam handles GET requests on /teams/:id
+func (handler *TeamHandler) handleGetTeam(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	tid, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+	teamID := portainer.TeamID(tid)
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if !security.AuthorizedTeamManagement(teamID, securityContext) {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	team, err := handler.TeamService.Team(teamID)
+	if err == portainer.ErrTeamNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, &team, handler.Logger)
+}
+
+// handlePutTeam handles PUT requests on /teams/:id
+func (handler *TeamHandler) handlePutTeam(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	teamID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var req putTeamRequest
+	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	team, err := handler.TeamService.Team(portainer.TeamID(teamID))
+	if err == portainer.ErrTeamNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if req.Name != "" {
+		team.Name = req.Name
+	}
+
+	err = handler.TeamService.UpdateTeam(team.ID, team)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
+
+// handleDeleteTeam handles DELETE requests on /teams/:id
+func (handler *TeamHandler) handleDeleteTeam(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	teamID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = handler.TeamService.Team(portainer.TeamID(teamID))
+
+	if err == portainer.ErrTeamNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	err = handler.TeamService.DeleteTeam(portainer.TeamID(teamID))
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	err = handler.TeamMembershipService.DeleteTeamMembershipByTeamID(portainer.TeamID(teamID))
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
+
+// handleGetMemberships handles GET requests on /teams/:id/memberships
+func (handler *TeamHandler) handleGetMemberships(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	tid, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+	teamID := portainer.TeamID(tid)
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if !security.AuthorizedTeamManagement(teamID, securityContext) {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	memberships, err := handler.TeamMembershipService.TeamMembershipsByTeamID(teamID)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, memberships, handler.Logger)
+}
@@ -0,0 +1,242 @@
+package handler
+
+import (
+	"strconv"
+
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/security"
+
+	"encoding/json"
+	"log"
+	"net/http"
+	"os"
+
+	"github.com/asaskevich/govalidator"
+	"github.com/gorilla/mux"
+)
+
+// TeamMembershipHandler represents an HTTP API handler for managing teams.
+type TeamMembershipHandler struct {
+	*mux.Router
+	Logger                 *log.Logger
+	TeamMembershipService  portainer.TeamMembershipService
+	ResourceControlService portainer.ResourceControlService
+}
+
+// NewTeamMembershipHandler returns a new instance of TeamMembershipHandler.
+func NewTeamMembershipHandler(bouncer *security.RequestBouncer) *TeamMembershipHandler {
+	h := &TeamMembershipHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+	}
+	h.Handle("/team_memberships",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handlePostTeamMemberships))).Methods(http.MethodPost)
+	h.Handle("/team_memberships",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleGetTeamsMemberships))).Methods(http.MethodGet)
+	h.Handle("/team_memberships/{id}",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handlePutTeamMembership))).Methods(http.MethodPut)
+	h.Handle("/team_memberships/{id}",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleDeleteTeamMembership))).Methods(http.MethodDelete)
+
+	return h
+}
+
+type (
+	postTeamMembershipsRequest struct {
+		UserID int `valid:"required"`
+		TeamID int `valid:"required"`
+		Role   int `valid:"required"`
+	}
+
+	postTeamMembershipsResponse struct {
+		ID int `json:"Id"`
+	}
+
+	putTeamMembershipRequest struct {
+		UserID int `valid:"required"`
+		TeamID int `valid:"required"`
+		Role   int `valid:"required"`
+	}
+)
+
+// handlePostTeamMemberships handles POST requests on /team_memberships
+func (handler *TeamMembershipHandler) handlePostTeamMemberships(w http.ResponseWriter, r *http.Request) {
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	var req postTeamMembershipsRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	userID := portainer.UserID(req.UserID)
+	teamID := portainer.TeamID(req.TeamID)
+	role := portainer.MembershipRole(req.Role)
+
+	if !security.AuthorizedTeamManagement(teamID, securityContext) {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	memberships, err := handler.TeamMembershipService.TeamMembershipsByUserID(userID)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	if len(memberships) > 0 {
+		for _, membership := range memberships {
+			if membership.UserID == userID && membership.TeamID == teamID {
+				httperror.WriteErrorResponse(w, portainer.ErrTeamMembershipAlreadyExists, http.StatusConflict, handler.Logger)
+				return
+			}
+		}
+	}
+
+	membership := &portainer.TeamMembership{
+		UserID: userID,
+		TeamID: teamID,
+		Role:   role,
+	}
+
+	err = handler.TeamMembershipService.CreateTeamMembership(membership)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, &postTeamMembershipsResponse{ID: int(membership.ID)}, handler.Logger)
+}
+
+// handleGetTeamsMemberships handles GET requests on /team_memberships
+func (handler *TeamMembershipHandler) handleGetTeamsMemberships(w http.ResponseWriter, r *http.Request) {
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if !securityContext.IsAdmin && !securityContext.IsTeamLeader {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	memberships, err := handler.TeamMembershipService.TeamMemberships()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, memberships, handler.Logger)
+}
+
+// handlePutTeamMembership handles PUT requests on /team_memberships/:id
+func (handler *TeamMembershipHandler) handlePutTeamMembership(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	membershipID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var req putTeamMembershipRequest
+	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	userID := portainer.UserID(req.UserID)
+	teamID := portainer.TeamID(req.TeamID)
+	role := portainer.MembershipRole(req.Role)
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if !security.AuthorizedTeamManagement(teamID, securityContext) {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	membership, err := handler.TeamMembershipService.TeamMembership(portainer.TeamMembershipID(membershipID))
+	if err == portainer.ErrTeamMembershipNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if securityContext.IsTeamLeader && membership.Role != role {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	membership.UserID = userID
+	membership.TeamID = teamID
+	membership.Role = role
+
+	err = handler.TeamMembershipService.UpdateTeamMembership(membership.ID, membership)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
+
+// handleDeleteTeamMembership handles DELETE requests on /team_memberships/:id
+func (handler *TeamMembershipHandler) handleDeleteTeamMembership(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	membershipID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	membership, err := handler.TeamMembershipService.TeamMembership(portainer.TeamMembershipID(membershipID))
+	if err == portainer.ErrTeamMembershipNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if !security.AuthorizedTeamManagement(membership.TeamID, securityContext) {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	err = handler.TeamMembershipService.DeleteTeamMembership(portainer.TeamMembershipID(membershipID))
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
@@ -0,0 +1,73 @@
+package handler
+
+import (
+	"io/ioutil"
+	"log"
+	"net/http"
+	"os"
+
+	"github.com/gorilla/mux"
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/security"
+)
+
+// TemplatesHandler represents an HTTP API handler for managing templates.
+type TemplatesHandler struct {
+	*mux.Router
+	Logger          *log.Logger
+	SettingsService portainer.SettingsService
+}
+
+const (
+	containerTemplatesURLLinuxServerIo = "https://tools.linuxserver.io/portainer.json"
+)
+
+// NewTemplatesHandler returns a new instance of TemplatesHandler.
+func NewTemplatesHandler(bouncer *security.RequestBouncer) *TemplatesHandler {
+	h := &TemplatesHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+	}
+	h.Handle("/templates",
+		bouncer.AuthenticatedAccess(http.HandlerFunc(h.handleGetTemplates))).Methods(http.MethodGet)
+	return h
+}
+
+// handleGetTemplates handles GET requests on /templates?key=<key>
+func (handler *TemplatesHandler) handleGetTemplates(w http.ResponseWriter, r *http.Request) {
+	key := r.FormValue("key")
+	if key == "" {
+		httperror.WriteErrorResponse(w, ErrInvalidQueryFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var templatesURL string
+	if key == "containers" {
+		settings, err := handler.SettingsService.Settings()
+		if err != nil {
+			httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+			return
+		}
+		templatesURL = settings.TemplatesURL
+	} else if key == "linuxserver.io" {
+		templatesURL = containerTemplatesURLLinuxServerIo
+	} else {
+		httperror.WriteErrorResponse(w, ErrInvalidQueryFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	resp, err := http.Get(templatesURL)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	defer resp.Body.Close()
+	body, err := ioutil.ReadAll(resp.Body)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	w.Header().Set("Content-Type", "application/json")
+	w.Write(body)
+}
@@ -1,12 +1,13 @@
-package http
+package handler

 import (
 	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/security"

 	"log"
 	"net/http"
 	"os"
-	"strconv"

 	"github.com/gorilla/mux"
 )
@@ -19,35 +20,31 @@ type UploadHandler struct {
 }

 // NewUploadHandler returns a new instance of UploadHandler.
-func NewUploadHandler(mw *middleWareService) *UploadHandler {
+func NewUploadHandler(bouncer *security.RequestBouncer) *UploadHandler {
 	h := &UploadHandler{
 		Router: mux.NewRouter(),
 		Logger: log.New(os.Stderr, "", log.LstdFlags),
 	}
-	h.Handle("/upload/tls/{endpointID}/{certificate:(?:ca|cert|key)}",
-		mw.authenticated(http.HandlerFunc(h.handlePostUploadTLS)))
+	h.Handle("/upload/tls/{certificate:(?:ca|cert|key)}",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePostUploadTLS))).Methods(http.MethodPost)
 	return h
 }

+// handlePostUploadTLS handles POST requests on /upload/tls/{certificate:(?:ca|cert|key)}?folder=folder
 func (handler *UploadHandler) handlePostUploadTLS(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		handleNotAllowed(w, []string{http.MethodPost})
-		return
-	}
-
 	vars := mux.Vars(r)
-	endpointID := vars["endpointID"]
 	certificate := vars["certificate"]
-	ID, err := strconv.Atoi(endpointID)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
+
+	folder := r.FormValue("folder")
+	if folder == "" {
+		httperror.WriteErrorResponse(w, ErrInvalidQueryFormat, http.StatusBadRequest, handler.Logger)
 		return
 	}

 	file, _, err := r.FormFile("file")
 	defer file.Close()
 	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
 		return
 	}

@@ -60,12 +57,13 @@ func (handler *UploadHandler) handlePostUploadTLS(w http.ResponseWriter, r *http
 	case "key":
 		fileType = portainer.TLSFileKey
 	default:
-		Error(w, portainer.ErrUndefinedTLSFileType, http.StatusInternalServerError, handler.Logger)
+		httperror.WriteErrorResponse(w, portainer.ErrUndefinedTLSFileType, http.StatusInternalServerError, handler.Logger)
 		return
 	}

-	err = handler.FileService.StoreTLSFile(portainer.EndpointID(ID), fileType, file)
+	err = handler.FileService.StoreTLSFile(folder, fileType, file)
 	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
 	}
 }
@@ -0,0 +1,468 @@
+package handler
+
+import (
+	"strconv"
+	"strings"
+
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/security"
+
+	"encoding/json"
+	"log"
+	"net/http"
+	"os"
+
+	"github.com/asaskevich/govalidator"
+	"github.com/gorilla/mux"
+)
+
+// UserHandler represents an HTTP API handler for managing users.
+type UserHandler struct {
+	*mux.Router
+	Logger                 *log.Logger
+	UserService            portainer.UserService
+	TeamService            portainer.TeamService
+	TeamMembershipService  portainer.TeamMembershipService
+	ResourceControlService portainer.ResourceControlService
+	CryptoService          portainer.CryptoService
+	SettingsService        portainer.SettingsService
+}
+
+// NewUserHandler returns a new instance of UserHandler.
+func NewUserHandler(bouncer *security.RequestBouncer) *UserHandler {
+	h := &UserHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+	}
+	h.Handle("/users",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handlePostUsers))).Methods(http.MethodPost)
+	h.Handle("/users",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleGetUsers))).Methods(http.MethodGet)
+	h.Handle("/users/{id}",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handleGetUser))).Methods(http.MethodGet)
+	h.Handle("/users/{id}",
+		bouncer.AuthenticatedAccess(http.HandlerFunc(h.handlePutUser))).Methods(http.MethodPut)
+	h.Handle("/users/{id}",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handleDeleteUser))).Methods(http.MethodDelete)
+	h.Handle("/users/{id}/memberships",
+		bouncer.AuthenticatedAccess(http.HandlerFunc(h.handleGetMemberships))).Methods(http.MethodGet)
+	h.Handle("/users/{id}/passwd",
+		bouncer.AuthenticatedAccess(http.HandlerFunc(h.handlePostUserPasswd))).Methods(http.MethodPost)
+	h.Handle("/users/admin/check",
+		bouncer.PublicAccess(http.HandlerFunc(h.handleGetAdminCheck))).Methods(http.MethodGet)
+	h.Handle("/users/admin/init",
+		bouncer.PublicAccess(http.HandlerFunc(h.handlePostAdminInit))).Methods(http.MethodPost)
+
+	return h
+}
+
+type (
+	postUsersRequest struct {
+		Username string `valid:"required"`
+		Password string `valid:""`
+		Role     int    `valid:"required"`
+	}
+
+	postUsersResponse struct {
+		ID int `json:"Id"`
+	}
+
+	postUserPasswdRequest struct {
+		Password string `valid:"required"`
+	}
+
+	postUserPasswdResponse struct {
+		Valid bool `json:"valid"`
+	}
+
+	putUserRequest struct {
+		Password string `valid:"-"`
+		Role     int    `valid:"-"`
+	}
+
+	postAdminInitRequest struct {
+		Username string `valid:"required"`
+		Password string `valid:"required"`
+	}
+)
+
+// handlePostUsers handles POST requests on /users
+func (handler *UserHandler) handlePostUsers(w http.ResponseWriter, r *http.Request) {
+	var req postUsersRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err := govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if !securityContext.IsAdmin && !securityContext.IsTeamLeader {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, nil)
+		return
+	}
+
+	if securityContext.IsTeamLeader && req.Role == 1 {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, nil)
+		return
+	}
+
+	if strings.ContainsAny(req.Username, " ") {
+		httperror.WriteErrorResponse(w, portainer.ErrInvalidUsername, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	user, err := handler.UserService.UserByUsername(req.Username)
+	if err != nil && err != portainer.ErrUserNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	if user != nil {
+		httperror.WriteErrorResponse(w, portainer.ErrUserAlreadyExists, http.StatusConflict, handler.Logger)
+		return
+	}
+
+	var role portainer.UserRole
+	if req.Role == 1 {
+		role = portainer.AdministratorRole
+	} else {
+		role = portainer.StandardUserRole
+	}
+
+	user = &portainer.User{
+		Username: req.Username,
+		Role:     role,
+	}
+
+	settings, err := handler.SettingsService.Settings()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if settings.AuthenticationMethod == portainer.AuthenticationInternal {
+		user.Password, err = handler.CryptoService.Hash(req.Password)
+		if err != nil {
+			httperror.WriteErrorResponse(w, portainer.ErrCryptoHashFailure, http.StatusBadRequest, handler.Logger)
+			return
+		}
+	}
+
+	err = handler.UserService.CreateUser(user)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, &postUsersResponse{ID: int(user.ID)}, handler.Logger)
+}
+
+// handleGetUsers handles GET requests on /users
+func (handler *UserHandler) handleGetUsers(w http.ResponseWriter, r *http.Request) {
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	users, err := handler.UserService.Users()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	filteredUsers := security.FilterUsers(users, securityContext)
+
+	for i := range filteredUsers {
+		filteredUsers[i].Password = ""
+	}
+
+	encodeJSON(w, filteredUsers, handler.Logger)
+}
+
+// handlePostUserPasswd handles POST requests on /users/:id/passwd
+func (handler *UserHandler) handlePostUserPasswd(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	userID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var req postUserPasswdRequest
+	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var password = req.Password
+
+	u, err := handler.UserService.User(portainer.UserID(userID))
+	if err == portainer.ErrUserNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	valid := true
+	err = handler.CryptoService.CompareHashAndData(u.Password, password)
+	if err != nil {
+		valid = false
+	}
+
+	encodeJSON(w, &postUserPasswdResponse{Valid: valid}, handler.Logger)
+}
+
+// handleGetUser handles GET requests on /users/:id
+func (handler *UserHandler) handleGetUser(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	userID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	user, err := handler.UserService.User(portainer.UserID(userID))
+	if err == portainer.ErrUserNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	user.Password = ""
+	encodeJSON(w, &user, handler.Logger)
+}
+
+// handlePutUser handles PUT requests on /users/:id
+func (handler *UserHandler) handlePutUser(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	userID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	tokenData, err := security.RetrieveTokenData(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if tokenData.Role != portainer.AdministratorRole && tokenData.ID != portainer.UserID(userID) {
+		httperror.WriteErrorResponse(w, portainer.ErrUnauthorized, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	var req putUserRequest
+	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	if req.Password == "" && req.Role == 0 {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	user, err := handler.UserService.User(portainer.UserID(userID))
+	if err == portainer.ErrUserNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if req.Password != "" {
+		user.Password, err = handler.CryptoService.Hash(req.Password)
+		if err != nil {
+			httperror.WriteErrorResponse(w, portainer.ErrCryptoHashFailure, http.StatusBadRequest, handler.Logger)
+			return
+		}
+	}
+
+	if req.Role != 0 {
+		if tokenData.Role != portainer.AdministratorRole {
+			httperror.WriteErrorResponse(w, portainer.ErrUnauthorized, http.StatusForbidden, handler.Logger)
+			return
+		}
+		if req.Role == 1 {
+			user.Role = portainer.AdministratorRole
+		} else {
+			user.Role = portainer.StandardUserRole
+		}
+	}
+
+	err = handler.UserService.UpdateUser(user.ID, user)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
+
+// handleGetAdminCheck handles GET requests on /users/admin/check
+func (handler *UserHandler) handleGetAdminCheck(w http.ResponseWriter, r *http.Request) {
+	users, err := handler.UserService.UsersByRole(portainer.AdministratorRole)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	if len(users) == 0 {
+		httperror.WriteErrorResponse(w, portainer.ErrUserNotFound, http.StatusNotFound, handler.Logger)
+		return
+	}
+}
+
+// handlePostAdminInit handles POST requests on /users/admin/init
+func (handler *UserHandler) handlePostAdminInit(w http.ResponseWriter, r *http.Request) {
+	var req postAdminInitRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err := govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	users, err := handler.UserService.UsersByRole(portainer.AdministratorRole)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	if len(users) == 0 {
+		user := &portainer.User{
+			Username: req.Username,
+			Role:     portainer.AdministratorRole,
+		}
+		user.Password, err = handler.CryptoService.Hash(req.Password)
+		if err != nil {
+			httperror.WriteErrorResponse(w, portainer.ErrCryptoHashFailure, http.StatusBadRequest, handler.Logger)
+			return
+		}
+
+		err = handler.UserService.CreateUser(user)
+		if err != nil {
+			httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+			return
+		}
+	} else {
+		httperror.WriteErrorResponse(w, portainer.ErrAdminAlreadyInitialized, http.StatusConflict, handler.Logger)
+		return
+	}
+}
+
+// handleDeleteUser handles DELETE requests on /users/:id
+func (handler *UserHandler) handleDeleteUser(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	userID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	if userID == 1 {
+		httperror.WriteErrorResponse(w, portainer.ErrCannotRemoveAdmin, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	tokenData, err := security.RetrieveTokenData(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if tokenData.ID == portainer.UserID(userID) {
+		httperror.WriteErrorResponse(w, portainer.ErrAdminCannotRemoveSelf, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	_, err = handler.UserService.User(portainer.UserID(userID))
+
+	if err == portainer.ErrUserNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	err = handler.UserService.DeleteUser(portainer.UserID(userID))
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	err = handler.TeamMembershipService.DeleteTeamMembershipByUserID(portainer.UserID(userID))
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
+
+// handleGetMemberships handles GET requests on /users/:id/memberships
+func (handler *UserHandler) handleGetMemberships(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	userID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	tokenData, err := security.RetrieveTokenData(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if tokenData.Role != portainer.AdministratorRole && tokenData.ID != portainer.UserID(userID) {
+		httperror.WriteErrorResponse(w, portainer.ErrUnauthorized, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	memberships, err := handler.TeamMembershipService.TeamMembershipsByUserID(portainer.UserID(userID))
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, memberships, handler.Logger)
+}
@@ -1,4 +1,4 @@
-package http
+package handler

 import (
 	"bytes"
@@ -17,6 +17,7 @@ import (

 	"github.com/gorilla/mux"
 	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/crypto"
 	"golang.org/x/net/websocket"
 )

@@ -70,10 +71,8 @@ func (handler *WebSocketHandler) webSocketDockerExec(ws *websocket.Conn) {

 	// Should not be managed here
 	var tlsConfig *tls.Config
-	if endpoint.TLS {
-		tlsConfig, err = createTLSConfiguration(endpoint.TLSCACertPath,
-			endpoint.TLSCertPath,
-			endpoint.TLSKeyPath)
+	if endpoint.TLSConfig.TLS {
+		tlsConfig, err = crypto.CreateTLSConfiguration(&endpoint.TLSConfig)
 		if err != nil {
 			log.Fatalf("Unable to create TLS configuration: %s", err)
 			return
@@ -1,119 +0,0 @@
-package http
-
-import (
-	"context"
-
-	"github.com/portainer/portainer"
-
-	"net/http"
-	"strings"
-)
-
-type (
-	// middleWareService represents a service to manage HTTP middlewares
-	middleWareService struct {
-		jwtService   portainer.JWTService
-		authDisabled bool
-	}
-	contextKey int
-)
-
-const (
-	contextAuthenticationKey contextKey = iota
-)
-
-func extractTokenDataFromRequestContext(request *http.Request) (*portainer.TokenData, error) {
-	contextData := request.Context().Value(contextAuthenticationKey)
-	if contextData == nil {
-		return nil, portainer.ErrMissingContextData
-	}
-
-	tokenData := contextData.(*portainer.TokenData)
-	return tokenData, nil
-}
-
-// public defines a chain of middleware for public endpoints (no authentication required)
-func (service *middleWareService) public(h http.Handler) http.Handler {
-	h = mwSecureHeaders(h)
-	return h
-}
-
-// authenticated defines a chain of middleware for private endpoints (authentication required)
-func (service *middleWareService) authenticated(h http.Handler) http.Handler {
-	h = service.mwCheckAuthentication(h)
-	h = mwSecureHeaders(h)
-	return h
-}
-
-// administrator defines a chain of middleware for private administrator restricted endpoints
-// (authentication and role admin required)
-func (service *middleWareService) administrator(h http.Handler) http.Handler {
-	h = mwCheckAdministratorRole(h)
-	h = service.mwCheckAuthentication(h)
-	h = mwSecureHeaders(h)
-	return h
-}
-
-// mwSecureHeaders provides secure headers middleware for handlers
-func mwSecureHeaders(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Add("X-Content-Type-Options", "nosniff")
-		w.Header().Add("X-Frame-Options", "DENY")
-		next.ServeHTTP(w, r)
-	})
-}
-
-// mwCheckAdministratorRole check the role of the user associated to the request
-func mwCheckAdministratorRole(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		tokenData, err := extractTokenDataFromRequestContext(r)
-		if err != nil {
-			Error(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, nil)
-			return
-		}
-
-		if tokenData.Role != portainer.AdministratorRole {
-			Error(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, nil)
-			return
-		}
-
-		next.ServeHTTP(w, r)
-	})
-}
-
-// mwCheckAuthentication provides Authentication middleware for handlers
-func (service *middleWareService) mwCheckAuthentication(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		var tokenData *portainer.TokenData
-		if !service.authDisabled {
-			var token string
-
-			// Get token from the Authorization header
-			tokens, ok := r.Header["Authorization"]
-			if ok && len(tokens) >= 1 {
-				token = tokens[0]
-				token = strings.TrimPrefix(token, "Bearer ")
-			}
-
-			if token == "" {
-				Error(w, portainer.ErrUnauthorized, http.StatusUnauthorized, nil)
-				return
-			}
-
-			var err error
-			tokenData, err = service.jwtService.ParseAndVerifyToken(token)
-			if err != nil {
-				Error(w, err, http.StatusUnauthorized, nil)
-				return
-			}
-		} else {
-			tokenData = &portainer.TokenData{
-				Role: portainer.AdministratorRole,
-			}
-		}
-
-		ctx := context.WithValue(r.Context(), contextAuthenticationKey, tokenData)
-		next.ServeHTTP(w, r.WithContext(ctx))
-		return
-	})
-}
@@ -0,0 +1,21 @@
+package proxy
+
+import "github.com/portainer/portainer"
+
+func canUserAccessResource(userID portainer.UserID, userTeamIDs []portainer.TeamID, resourceControl *portainer.ResourceControl) bool {
+	for _, authorizedUserAccess := range resourceControl.UserAccesses {
+		if userID == authorizedUserAccess.UserID {
+			return true
+		}
+	}
+
+	for _, authorizedTeamAccess := range resourceControl.TeamAccesses {
+		for _, userTeamID := range userTeamIDs {
+			if userTeamID == authorizedTeamAccess.TeamID {
+				return true
+			}
+		}
+	}
+
+	return false
+}
@@ -0,0 +1,108 @@
+package proxy
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer"
+)
+
+const (
+	// ErrDockerContainerIdentifierNotFound defines an error raised when Portainer is unable to find a container identifier
+	ErrDockerContainerIdentifierNotFound = portainer.Error("Docker container identifier not found")
+	containerIdentifier                  = "Id"
+	containerLabelForServiceIdentifier   = "com.docker.swarm.service.id"
+)
+
+// containerListOperation extracts the response as a JSON object, loop through the containers array
+// decorate and/or filter the containers based on resource controls before rewriting the response
+func containerListOperation(request *http.Request, response *http.Response, executor *operationExecutor) error {
+	var err error
+	// ContainerList response is a JSON array
+	// https://docs.docker.com/engine/api/v1.28/#operation/ContainerList
+	responseArray, err := getResponseAsJSONArray(response)
+	if err != nil {
+		return err
+	}
+
+	if executor.operationContext.isAdmin {
+		responseArray, err = decorateContainerList(responseArray, executor.operationContext.resourceControls)
+	} else {
+		responseArray, err = filterContainerList(responseArray, executor.operationContext.resourceControls,
+			executor.operationContext.userID, executor.operationContext.userTeamIDs)
+	}
+	if err != nil {
+		return err
+	}
+
+	if executor.labelBlackList != nil {
+		responseArray, err = filterContainersWithBlackListedLabels(responseArray, executor.labelBlackList)
+		if err != nil {
+			return err
+		}
+	}
+
+	return rewriteResponse(response, responseArray, http.StatusOK)
+}
+
+// containerInspectOperation extracts the response as a JSON object, verify that the user
+// has access to the container based on resource control (check are done based on the containerID and optional Swarm service ID)
+// and either rewrite an access denied response or a decorated container.
+func containerInspectOperation(request *http.Request, response *http.Response, executor *operationExecutor) error {
+	// ContainerInspect response is a JSON object
+	// https://docs.docker.com/engine/api/v1.28/#operation/ContainerInspect
+	responseObject, err := getResponseAsJSONOBject(response)
+	if err != nil {
+		return err
+	}
+
+	if responseObject[containerIdentifier] == nil {
+		return ErrDockerContainerIdentifierNotFound
+	}
+	containerID := responseObject[containerIdentifier].(string)
+
+	resourceControl := getResourceControlByResourceID(containerID, executor.operationContext.resourceControls)
+	if resourceControl != nil {
+		if executor.operationContext.isAdmin || canUserAccessResource(executor.operationContext.userID,
+			executor.operationContext.userTeamIDs, resourceControl) {
+			responseObject = decorateObject(responseObject, resourceControl)
+		} else {
+			return rewriteAccessDeniedResponse(response)
+		}
+	}
+
+	containerLabels := extractContainerLabelsFromContainerInspectObject(responseObject)
+	if containerLabels != nil && containerLabels[containerLabelForServiceIdentifier] != nil {
+		serviceID := containerLabels[containerLabelForServiceIdentifier].(string)
+		resourceControl := getResourceControlByResourceID(serviceID, executor.operationContext.resourceControls)
+		if resourceControl != nil {
+			if executor.operationContext.isAdmin || canUserAccessResource(executor.operationContext.userID,
+				executor.operationContext.userTeamIDs, resourceControl) {
+				responseObject = decorateObject(responseObject, resourceControl)
+			} else {
+				return rewriteAccessDeniedResponse(response)
+			}
+		}
+	}
+
+	return rewriteResponse(response, responseObject, http.StatusOK)
+}
+
+// extractContainerLabelsFromContainerInspectObject retrieve the Labels of the container if present.
+// Container schema reference: https://docs.docker.com/engine/api/v1.28/#operation/ContainerInspect
+func extractContainerLabelsFromContainerInspectObject(responseObject map[string]interface{}) map[string]interface{} {
+	// Labels are stored under Config.Labels
+	containerConfigObject := extractJSONField(responseObject, "Config")
+	if containerConfigObject != nil {
+		containerLabelsObject := extractJSONField(containerConfigObject, "Labels")
+		return containerLabelsObject
+	}
+	return nil
+}
+
+// extractContainerLabelsFromContainerListObject retrieve the Labels of the container if present.
+// Container schema reference: https://docs.docker.com/engine/api/v1.28/#operation/ContainerList
+func extractContainerLabelsFromContainerListObject(responseObject map[string]interface{}) map[string]interface{} {
+	// Labels are stored under Labels
+	containerLabelsObject := extractJSONField(responseObject, "Labels")
+	return containerLabelsObject
+}
@@ -0,0 +1,138 @@
+package proxy
+
+import "github.com/portainer/portainer"
+
+// decorateVolumeList loops through all volumes and will decorate any volume with an existing resource control.
+// Volume object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/VolumeList
+func decorateVolumeList(volumeData []interface{}, resourceControls []portainer.ResourceControl) ([]interface{}, error) {
+	decoratedVolumeData := make([]interface{}, 0)
+
+	for _, volume := range volumeData {
+
+		volumeObject := volume.(map[string]interface{})
+		if volumeObject[volumeIdentifier] == nil {
+			return nil, ErrDockerVolumeIdentifierNotFound
+		}
+
+		volumeID := volumeObject[volumeIdentifier].(string)
+		resourceControl := getResourceControlByResourceID(volumeID, resourceControls)
+		if resourceControl != nil {
+			volumeObject = decorateObject(volumeObject, resourceControl)
+		}
+		decoratedVolumeData = append(decoratedVolumeData, volumeObject)
+	}
+
+	return decoratedVolumeData, nil
+}
+
+// decorateContainerList loops through all containers and will decorate any container with an existing resource control.
+// Check is based on the container ID and optional Swarm service ID.
+// Container object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/ContainerList
+func decorateContainerList(containerData []interface{}, resourceControls []portainer.ResourceControl) ([]interface{}, error) {
+	decoratedContainerData := make([]interface{}, 0)
+
+	for _, container := range containerData {
+
+		containerObject := container.(map[string]interface{})
+		if containerObject[containerIdentifier] == nil {
+			return nil, ErrDockerContainerIdentifierNotFound
+		}
+
+		containerID := containerObject[containerIdentifier].(string)
+		resourceControl := getResourceControlByResourceID(containerID, resourceControls)
+		if resourceControl != nil {
+			containerObject = decorateObject(containerObject, resourceControl)
+		}
+
+		containerLabels := extractContainerLabelsFromContainerListObject(containerObject)
+		if containerLabels != nil && containerLabels[containerLabelForServiceIdentifier] != nil {
+			serviceID := containerLabels[containerLabelForServiceIdentifier].(string)
+			resourceControl := getResourceControlByResourceID(serviceID, resourceControls)
+			if resourceControl != nil {
+				containerObject = decorateObject(containerObject, resourceControl)
+			}
+		}
+
+		decoratedContainerData = append(decoratedContainerData, containerObject)
+	}
+
+	return decoratedContainerData, nil
+}
+
+// decorateServiceList loops through all services and will decorate any service with an existing resource control.
+// Service object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/ServiceList
+func decorateServiceList(serviceData []interface{}, resourceControls []portainer.ResourceControl) ([]interface{}, error) {
+	decoratedServiceData := make([]interface{}, 0)
+
+	for _, service := range serviceData {
+
+		serviceObject := service.(map[string]interface{})
+		if serviceObject[serviceIdentifier] == nil {
+			return nil, ErrDockerServiceIdentifierNotFound
+		}
+
+		serviceID := serviceObject[serviceIdentifier].(string)
+		resourceControl := getResourceControlByResourceID(serviceID, resourceControls)
+		if resourceControl != nil {
+			serviceObject = decorateObject(serviceObject, resourceControl)
+		}
+		decoratedServiceData = append(decoratedServiceData, serviceObject)
+	}
+
+	return decoratedServiceData, nil
+}
+
+// decorateNetworkList loops through all networks and will decorate any network with an existing resource control.
+// Network object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/NetworkList
+func decorateNetworkList(networkData []interface{}, resourceControls []portainer.ResourceControl) ([]interface{}, error) {
+	decoratedNetworkData := make([]interface{}, 0)
+
+	for _, network := range networkData {
+
+		networkObject := network.(map[string]interface{})
+		if networkObject[networkIdentifier] == nil {
+			return nil, ErrDockerNetworkIdentifierNotFound
+		}
+
+		networkID := networkObject[networkIdentifier].(string)
+		resourceControl := getResourceControlByResourceID(networkID, resourceControls)
+		if resourceControl != nil {
+			networkObject = decorateObject(networkObject, resourceControl)
+		}
+
+		decoratedNetworkData = append(decoratedNetworkData, networkObject)
+	}
+
+	return decoratedNetworkData, nil
+}
+
+// decorateSecretList loops through all secrets and will decorate any secret with an existing resource control.
+// Secret object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/SecretList
+func decorateSecretList(secretData []interface{}, resourceControls []portainer.ResourceControl) ([]interface{}, error) {
+	decoratedSecretData := make([]interface{}, 0)
+
+	for _, secret := range secretData {
+
+		secretObject := secret.(map[string]interface{})
+		if secretObject[secretIdentifier] == nil {
+			return nil, ErrDockerSecretIdentifierNotFound
+		}
+
+		secretID := secretObject[secretIdentifier].(string)
+		resourceControl := getResourceControlByResourceID(secretID, resourceControls)
+		if resourceControl != nil {
+			secretObject = decorateObject(secretObject, resourceControl)
+		}
+
+		decoratedSecretData = append(decoratedSecretData, secretObject)
+	}
+
+	return decoratedSecretData, nil
+}
+
+func decorateObject(object map[string]interface{}, resourceControl *portainer.ResourceControl) map[string]interface{} {
+	metadata := make(map[string]interface{})
+	metadata["ResourceControl"] = resourceControl
+	object["Portainer"] = metadata
+	return object
+}
@@ -0,0 +1,58 @@
+package proxy
+
+import (
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/crypto"
+)
+
+// proxyFactory is a factory to create reverse proxies to Docker endpoints
+type proxyFactory struct {
+	ResourceControlService portainer.ResourceControlService
+	TeamMembershipService  portainer.TeamMembershipService
+	SettingsService        portainer.SettingsService
+}
+
+func (factory *proxyFactory) newHTTPProxy(u *url.URL) http.Handler {
+	u.Scheme = "http"
+	return factory.createReverseProxy(u)
+}
+
+func (factory *proxyFactory) newHTTPSProxy(u *url.URL, endpoint *portainer.Endpoint) (http.Handler, error) {
+	u.Scheme = "https"
+	proxy := factory.createReverseProxy(u)
+	config, err := crypto.CreateTLSConfiguration(&endpoint.TLSConfig)
+	if err != nil {
+		return nil, err
+	}
+
+	proxy.Transport.(*proxyTransport).dockerTransport.TLSClientConfig = config
+	return proxy, nil
+}
+
+func (factory *proxyFactory) newSocketProxy(path string) http.Handler {
+	proxy := &socketProxy{}
+	transport := &proxyTransport{
+		ResourceControlService: factory.ResourceControlService,
+		TeamMembershipService:  factory.TeamMembershipService,
+		SettingsService:        factory.SettingsService,
+		dockerTransport:        newSocketTransport(path),
+	}
+	proxy.Transport = transport
+	return proxy
+}
+
+func (factory *proxyFactory) createReverseProxy(u *url.URL) *httputil.ReverseProxy {
+	proxy := newSingleHostReverseProxyWithHostHeader(u)
+	transport := &proxyTransport{
+		ResourceControlService: factory.ResourceControlService,
+		TeamMembershipService:  factory.TeamMembershipService,
+		SettingsService:        factory.SettingsService,
+		dockerTransport:        newHTTPTransport(),
+	}
+	proxy.Transport = transport
+	return proxy
+}
@@ -0,0 +1,185 @@
+package proxy
+
+import "github.com/portainer/portainer"
+
+// filterVolumeList loops through all volumes, filters volumes without any resource control (public resources) or with
+// any resource control giving access to the user (these volumes will be decorated).
+// Volume object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/VolumeList
+func filterVolumeList(volumeData []interface{}, resourceControls []portainer.ResourceControl, userID portainer.UserID, userTeamIDs []portainer.TeamID) ([]interface{}, error) {
+	filteredVolumeData := make([]interface{}, 0)
+
+	for _, volume := range volumeData {
+		volumeObject := volume.(map[string]interface{})
+		if volumeObject[volumeIdentifier] == nil {
+			return nil, ErrDockerVolumeIdentifierNotFound
+		}
+
+		volumeID := volumeObject[volumeIdentifier].(string)
+		resourceControl := getResourceControlByResourceID(volumeID, resourceControls)
+		if resourceControl == nil {
+			filteredVolumeData = append(filteredVolumeData, volumeObject)
+		} else if resourceControl != nil && canUserAccessResource(userID, userTeamIDs, resourceControl) {
+			volumeObject = decorateObject(volumeObject, resourceControl)
+			filteredVolumeData = append(filteredVolumeData, volumeObject)
+		}
+	}
+
+	return filteredVolumeData, nil
+}
+
+// filterContainerList loops through all containers, filters containers without any resource control (public resources) or with
+// any resource control giving access to the user (check on container ID and optional Swarm service ID, these containers will be decorated).
+// Container object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/ContainerList
+func filterContainerList(containerData []interface{}, resourceControls []portainer.ResourceControl, userID portainer.UserID, userTeamIDs []portainer.TeamID) ([]interface{}, error) {
+	filteredContainerData := make([]interface{}, 0)
+
+	for _, container := range containerData {
+		containerObject := container.(map[string]interface{})
+		if containerObject[containerIdentifier] == nil {
+			return nil, ErrDockerContainerIdentifierNotFound
+		}
+
+		containerID := containerObject[containerIdentifier].(string)
+		resourceControl := getResourceControlByResourceID(containerID, resourceControls)
+		if resourceControl == nil {
+			// check if container is part of a Swarm service
+			containerLabels := extractContainerLabelsFromContainerListObject(containerObject)
+			if containerLabels != nil && containerLabels[containerLabelForServiceIdentifier] != nil {
+				serviceID := containerLabels[containerLabelForServiceIdentifier].(string)
+				serviceResourceControl := getResourceControlByResourceID(serviceID, resourceControls)
+				if serviceResourceControl == nil {
+					filteredContainerData = append(filteredContainerData, containerObject)
+				} else if serviceResourceControl != nil && canUserAccessResource(userID, userTeamIDs, serviceResourceControl) {
+					containerObject = decorateObject(containerObject, serviceResourceControl)
+					filteredContainerData = append(filteredContainerData, containerObject)
+				}
+			} else {
+				filteredContainerData = append(filteredContainerData, containerObject)
+			}
+		} else if resourceControl != nil && canUserAccessResource(userID, userTeamIDs, resourceControl) {
+			containerObject = decorateObject(containerObject, resourceControl)
+			filteredContainerData = append(filteredContainerData, containerObject)
+		}
+	}
+
+	return filteredContainerData, nil
+}
+
+// filterContainersWithLabels loops through a list of containers, and filters containers that do not contains
+// any labels in the labels black list.
+func filterContainersWithBlackListedLabels(containerData []interface{}, labelBlackList []portainer.Pair) ([]interface{}, error) {
+	filteredContainerData := make([]interface{}, 0)
+
+	for _, container := range containerData {
+		containerObject := container.(map[string]interface{})
+
+		containerLabels := extractContainerLabelsFromContainerListObject(containerObject)
+		if containerLabels != nil {
+			if !containerHasBlackListedLabel(containerLabels, labelBlackList) {
+				filteredContainerData = append(filteredContainerData, containerObject)
+			}
+		} else {
+			filteredContainerData = append(filteredContainerData, containerObject)
+		}
+	}
+
+	return filteredContainerData, nil
+}
+
+// filterServiceList loops through all services, filters services without any resource control (public resources) or with
+// any resource control giving access to the user (these services will be decorated).
+// Service object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/ServiceList
+func filterServiceList(serviceData []interface{}, resourceControls []portainer.ResourceControl, userID portainer.UserID, userTeamIDs []portainer.TeamID) ([]interface{}, error) {
+	filteredServiceData := make([]interface{}, 0)
+
+	for _, service := range serviceData {
+		serviceObject := service.(map[string]interface{})
+		if serviceObject[serviceIdentifier] == nil {
+			return nil, ErrDockerServiceIdentifierNotFound
+		}
+
+		serviceID := serviceObject[serviceIdentifier].(string)
+		resourceControl := getResourceControlByResourceID(serviceID, resourceControls)
+		if resourceControl == nil {
+			filteredServiceData = append(filteredServiceData, serviceObject)
+		} else if resourceControl != nil && canUserAccessResource(userID, userTeamIDs, resourceControl) {
+			serviceObject = decorateObject(serviceObject, resourceControl)
+			filteredServiceData = append(filteredServiceData, serviceObject)
+		}
+	}
+
+	return filteredServiceData, nil
+}
+
+// filterNetworkList loops through all networks, filters networks without any resource control (public resources) or with
+// any resource control giving access to the user (these networks will be decorated).
+// Network object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/NetworkList
+func filterNetworkList(networkData []interface{}, resourceControls []portainer.ResourceControl, userID portainer.UserID, userTeamIDs []portainer.TeamID) ([]interface{}, error) {
+	filteredNetworkData := make([]interface{}, 0)
+
+	for _, network := range networkData {
+		networkObject := network.(map[string]interface{})
+		if networkObject[networkIdentifier] == nil {
+			return nil, ErrDockerNetworkIdentifierNotFound
+		}
+
+		networkID := networkObject[networkIdentifier].(string)
+		resourceControl := getResourceControlByResourceID(networkID, resourceControls)
+		if resourceControl == nil {
+			filteredNetworkData = append(filteredNetworkData, networkObject)
+		} else if resourceControl != nil && canUserAccessResource(userID, userTeamIDs, resourceControl) {
+			networkObject = decorateObject(networkObject, resourceControl)
+			filteredNetworkData = append(filteredNetworkData, networkObject)
+		}
+	}
+
+	return filteredNetworkData, nil
+}
+
+// filterSecretList loops through all secrets, filters secrets without any resource control (public resources) or with
+// any resource control giving access to the user (these secrets will be decorated).
+// Secret object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/SecretList
+func filterSecretList(secretData []interface{}, resourceControls []portainer.ResourceControl, userID portainer.UserID, userTeamIDs []portainer.TeamID) ([]interface{}, error) {
+	filteredSecretData := make([]interface{}, 0)
+
+	for _, secret := range secretData {
+		secretObject := secret.(map[string]interface{})
+		if secretObject[secretIdentifier] == nil {
+			return nil, ErrDockerSecretIdentifierNotFound
+		}
+
+		secretID := secretObject[secretIdentifier].(string)
+		resourceControl := getResourceControlByResourceID(secretID, resourceControls)
+		if resourceControl == nil {
+			filteredSecretData = append(filteredSecretData, secretObject)
+		} else if resourceControl != nil && canUserAccessResource(userID, userTeamIDs, resourceControl) {
+			secretObject = decorateObject(secretObject, resourceControl)
+			filteredSecretData = append(filteredSecretData, secretObject)
+		}
+	}
+
+	return filteredSecretData, nil
+}
+
+// filterTaskList loops through all tasks, filters tasks without any resource control (public resources) or with
+// any resource control giving access to the user based on the associated service identifier.
+// Task object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/TaskList
+func filterTaskList(taskData []interface{}, resourceControls []portainer.ResourceControl, userID portainer.UserID, userTeamIDs []portainer.TeamID) ([]interface{}, error) {
+	filteredTaskData := make([]interface{}, 0)
+
+	for _, task := range taskData {
+		taskObject := task.(map[string]interface{})
+		if taskObject[taskServiceIdentifier] == nil {
+			return nil, ErrDockerTaskServiceIdentifierNotFound
+		}
+
+		serviceID := taskObject[taskServiceIdentifier].(string)
+
+		resourceControl := getResourceControlByResourceID(serviceID, resourceControls)
+		if resourceControl == nil || (resourceControl != nil && canUserAccessResource(userID, userTeamIDs, resourceControl)) {
+			filteredTaskData = append(filteredTaskData, taskObject)
+		}
+	}
+
+	return filteredTaskData, nil
+}
@@ -0,0 +1,69 @@
+package proxy
+
+import (
+	"net/http"
+	"net/url"
+
+	"github.com/orcaman/concurrent-map"
+	"github.com/portainer/portainer"
+)
+
+// Manager represents a service used to manage Docker proxies.
+type Manager struct {
+	proxyFactory *proxyFactory
+	proxies      cmap.ConcurrentMap
+}
+
+// NewManager initializes a new proxy Service
+func NewManager(resourceControlService portainer.ResourceControlService, teamMembershipService portainer.TeamMembershipService, settingsService portainer.SettingsService) *Manager {
+	return &Manager{
+		proxies: cmap.New(),
+		proxyFactory: &proxyFactory{
+			ResourceControlService: resourceControlService,
+			TeamMembershipService:  teamMembershipService,
+			SettingsService:        settingsService,
+		},
+	}
+}
+
+// CreateAndRegisterProxy creates a new HTTP reverse proxy and adds it to the registered proxies.
+// It can also be used to create a new HTTP reverse proxy and replace an already registered proxy.
+func (manager *Manager) CreateAndRegisterProxy(endpoint *portainer.Endpoint) (http.Handler, error) {
+	var proxy http.Handler
+
+	endpointURL, err := url.Parse(endpoint.URL)
+	if err != nil {
+		return nil, err
+	}
+
+	if endpointURL.Scheme == "tcp" {
+		if endpoint.TLSConfig.TLS {
+			proxy, err = manager.proxyFactory.newHTTPSProxy(endpointURL, endpoint)
+			if err != nil {
+				return nil, err
+			}
+		} else {
+			proxy = manager.proxyFactory.newHTTPProxy(endpointURL)
+		}
+	} else {
+		// Assume unix:// scheme
+		proxy = manager.proxyFactory.newSocketProxy(endpointURL.Path)
+	}
+
+	manager.proxies.Set(string(endpoint.ID), proxy)
+	return proxy, nil
+}
+
+// GetProxy returns the proxy associated to a key
+func (manager *Manager) GetProxy(key string) http.Handler {
+	proxy, ok := manager.proxies.Get(key)
+	if !ok {
+		return nil
+	}
+	return proxy.(http.Handler)
+}
+
+// DeleteProxy deletes the proxy associated to a key
+func (manager *Manager) DeleteProxy(key string) {
+	manager.proxies.Remove(key)
+}
@@ -0,0 +1,66 @@
+package proxy
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer"
+)
+
+const (
+	// ErrDockerNetworkIdentifierNotFound defines an error raised when Portainer is unable to find a network identifier
+	ErrDockerNetworkIdentifierNotFound = portainer.Error("Docker network identifier not found")
+	networkIdentifier                  = "Id"
+)
+
+// networkListOperation extracts the response as a JSON object, loop through the networks array
+// decorate and/or filter the networks based on resource controls before rewriting the response
+func networkListOperation(request *http.Request, response *http.Response, executor *operationExecutor) error {
+	var err error
+	// NetworkList response is a JSON array
+	// https://docs.docker.com/engine/api/v1.28/#operation/NetworkList
+	responseArray, err := getResponseAsJSONArray(response)
+	if err != nil {
+		return err
+	}
+
+	if executor.operationContext.isAdmin {
+		responseArray, err = decorateNetworkList(responseArray, executor.operationContext.resourceControls)
+	} else {
+		responseArray, err = filterNetworkList(responseArray, executor.operationContext.resourceControls,
+			executor.operationContext.userID, executor.operationContext.userTeamIDs)
+	}
+	if err != nil {
+		return err
+	}
+
+	return rewriteResponse(response, responseArray, http.StatusOK)
+}
+
+// networkInspectOperation extracts the response as a JSON object, verify that the user
+// has access to the network based on resource control and either rewrite an access denied response
+// or a decorated network.
+func networkInspectOperation(request *http.Request, response *http.Response, executor *operationExecutor) error {
+	// NetworkInspect response is a JSON object
+	// https://docs.docker.com/engine/api/v1.28/#operation/NetworkInspect
+	responseObject, err := getResponseAsJSONOBject(response)
+	if err != nil {
+		return err
+	}
+
+	if responseObject[networkIdentifier] == nil {
+		return ErrDockerNetworkIdentifierNotFound
+	}
+	networkID := responseObject[networkIdentifier].(string)
+
+	resourceControl := getResourceControlByResourceID(networkID, executor.operationContext.resourceControls)
+	if resourceControl != nil {
+		if executor.operationContext.isAdmin || canUserAccessResource(executor.operationContext.userID,
+			executor.operationContext.userTeamIDs, resourceControl) {
+			responseObject = decorateObject(responseObject, resourceControl)
+		} else {
+			return rewriteAccessDeniedResponse(response)
+		}
+	}
+
+	return rewriteResponse(response, responseObject, http.StatusOK)
+}
@@ -0,0 +1,95 @@
+package proxy
+
+import (
+	"bytes"
+	"encoding/json"
+	"io/ioutil"
+	"net/http"
+	"strconv"
+
+	"github.com/portainer/portainer"
+)
+
+const (
+	// ErrEmptyResponseBody defines an error raised when portainer excepts to parse the body of a HTTP response and there is nothing to parse
+	ErrEmptyResponseBody = portainer.Error("Empty response body")
+)
+
+func extractJSONField(jsonObject map[string]interface{}, key string) map[string]interface{} {
+	object := jsonObject[key]
+	if object != nil {
+		return object.(map[string]interface{})
+	}
+	return nil
+}
+
+func getResponseAsJSONOBject(response *http.Response) (map[string]interface{}, error) {
+	responseData, err := getResponseBodyAsGenericJSON(response)
+	if err != nil {
+		return nil, err
+	}
+
+	responseObject := responseData.(map[string]interface{})
+	return responseObject, nil
+}
+
+func getResponseAsJSONArray(response *http.Response) ([]interface{}, error) {
+	responseData, err := getResponseBodyAsGenericJSON(response)
+	if err != nil {
+		return nil, err
+	}
+
+	responseObject := responseData.([]interface{})
+	return responseObject, nil
+}
+
+func getResponseBodyAsGenericJSON(response *http.Response) (interface{}, error) {
+	var data interface{}
+	if response.Body != nil {
+		body, err := ioutil.ReadAll(response.Body)
+		if err != nil {
+			return nil, err
+		}
+
+		err = response.Body.Close()
+		if err != nil {
+			return nil, err
+		}
+
+		err = json.Unmarshal(body, &data)
+		if err != nil {
+			return nil, err
+		}
+
+		return data, nil
+	}
+	return nil, ErrEmptyResponseBody
+}
+
+func writeAccessDeniedResponse() (*http.Response, error) {
+	response := &http.Response{}
+	err := rewriteResponse(response, portainer.ErrResourceAccessDenied, http.StatusForbidden)
+	return response, err
+}
+
+func rewriteAccessDeniedResponse(response *http.Response) error {
+	return rewriteResponse(response, portainer.ErrResourceAccessDenied, http.StatusForbidden)
+}
+
+func rewriteResponse(response *http.Response, newResponseData interface{}, statusCode int) error {
+	jsonData, err := json.Marshal(newResponseData)
+	if err != nil {
+		return err
+	}
+	body := ioutil.NopCloser(bytes.NewReader(jsonData))
+	response.StatusCode = statusCode
+	response.Body = body
+	response.ContentLength = int64(len(jsonData))
+
+	if response.Header == nil {
+		response.Header = make(http.Header)
+	}
+	response.Header.Set("Content-Length", strconv.Itoa(len(jsonData)))
+
+	return nil
+}
@@ -0,0 +1,46 @@
+package proxy
+
+import (
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+	"strings"
+)
+
+// NewSingleHostReverseProxyWithHostHeader is based on NewSingleHostReverseProxy
+// from golang.org/src/net/http/httputil/reverseproxy.go and merely sets the Host
+// HTTP header, which NewSingleHostReverseProxy deliberately preserves.
+func newSingleHostReverseProxyWithHostHeader(target *url.URL) *httputil.ReverseProxy {
+	targetQuery := target.RawQuery
+	director := func(req *http.Request) {
+		req.URL.Scheme = target.Scheme
+		req.URL.Host = target.Host
+		req.URL.Path = singleJoiningSlash(target.Path, req.URL.Path)
+		req.Host = req.URL.Host
+		if targetQuery == "" || req.URL.RawQuery == "" {
+			req.URL.RawQuery = targetQuery + req.URL.RawQuery
+		} else {
+			req.URL.RawQuery = targetQuery + "&" + req.URL.RawQuery
+		}
+		if _, ok := req.Header["User-Agent"]; !ok {
+			// explicitly disable User-Agent so it's not set to default value
+			req.Header.Set("User-Agent", "")
+		}
+	}
+	return &httputil.ReverseProxy{Director: director}
+}
+
+// singleJoiningSlash from golang.org/src/net/http/httputil/reverseproxy.go
+// included here for use in NewSingleHostReverseProxyWithHostHeader
+// because its used in NewSingleHostReverseProxy from golang.org/src/net/http/httputil/reverseproxy.go
+func singleJoiningSlash(a, b string) string {
+	aslash := strings.HasSuffix(a, "/")
+	bslash := strings.HasPrefix(b, "/")
+	switch {
+	case aslash && bslash:
+		return a + b[1:]
+	case !aslash && !bslash:
+		return a + "/" + b
+	}
+	return a + b
+}
@@ -0,0 +1,67 @@
+package proxy
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer"
+)
+
+const (
+	// ErrDockerSecretIdentifierNotFound defines an error raised when Portainer is unable to find a secret identifier
+	ErrDockerSecretIdentifierNotFound = portainer.Error("Docker secret identifier not found")
+	secretIdentifier                  = "ID"
+)
+
+// secretListOperation extracts the response as a JSON object, loop through the secrets array
+// decorate and/or filter the secrets based on resource controls before rewriting the response
+func secretListOperation(request *http.Request, response *http.Response, executor *operationExecutor) error {
+	var err error
+
+	// SecretList response is a JSON array
+	// https://docs.docker.com/engine/api/v1.28/#operation/SecretList
+	responseArray, err := getResponseAsJSONArray(response)
+	if err != nil {
+		return err
+	}
+
+	if executor.operationContext.isAdmin {
+		responseArray, err = decorateSecretList(responseArray, executor.operationContext.resourceControls)
+	} else {
+		responseArray, err = filterSecretList(responseArray, executor.operationContext.resourceControls,
+			executor.operationContext.userID, executor.operationContext.userTeamIDs)
+	}
+	if err != nil {
+		return err
+	}
+
+	return rewriteResponse(response, responseArray, http.StatusOK)
+}
+
+// secretInspectOperation extracts the response as a JSON object, verify that the user
+// has access to the secret based on resource control (check are done based on the secretID and optional Swarm service ID)
+// and either rewrite an access denied response or a decorated secret.
+func secretInspectOperation(request *http.Request, response *http.Response, executor *operationExecutor) error {
+	// SecretInspect response is a JSON object
+	// https://docs.docker.com/engine/api/v1.28/#operation/SecretInspect
+	responseObject, err := getResponseAsJSONOBject(response)
+	if err != nil {
+		return err
+	}
+
+	if responseObject[secretIdentifier] == nil {
+		return ErrDockerSecretIdentifierNotFound
+	}
+	secretID := responseObject[secretIdentifier].(string)
+
+	resourceControl := getResourceControlByResourceID(secretID, executor.operationContext.resourceControls)
+	if resourceControl != nil {
+		if executor.operationContext.isAdmin || canUserAccessResource(executor.operationContext.userID,
+			executor.operationContext.userTeamIDs, resourceControl) {
+			responseObject = decorateObject(responseObject, resourceControl)
+		} else {
+			return rewriteAccessDeniedResponse(response)
+		}
+	}
+
+	return rewriteResponse(response, responseObject, http.StatusOK)
+}
@@ -0,0 +1,64 @@
+package proxy
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer"
+)
+
+const (
+	// ErrDockerServiceIdentifierNotFound defines an error raised when Portainer is unable to find a service identifier
+	ErrDockerServiceIdentifierNotFound = portainer.Error("Docker service identifier not found")
+	serviceIdentifier                  = "ID"
+)
+
+// serviceListOperation extracts the response as a JSON array, loop through the service array
+// decorate and/or filter the services based on resource controls before rewriting the response
+func serviceListOperation(request *http.Request, response *http.Response, executor *operationExecutor) error {
+	var err error
+	// ServiceList response is a JSON array
+	// https://docs.docker.com/engine/api/v1.28/#operation/ServiceList
+	responseArray, err := getResponseAsJSONArray(response)
+	if err != nil {
+		return err
+	}
+
+	if executor.operationContext.isAdmin {
+		responseArray, err = decorateServiceList(responseArray, executor.operationContext.resourceControls)
+	} else {
+		responseArray, err = filterServiceList(responseArray, executor.operationContext.resourceControls, executor.operationContext.userID, executor.operationContext.userTeamIDs)
+	}
+	if err != nil {
+		return err
+	}
+
+	return rewriteResponse(response, responseArray, http.StatusOK)
+}
+
+// serviceInspectOperation extracts the response as a JSON object, verify that the user
+// has access to the service based on resource control and either rewrite an access denied response
+// or a decorated service.
+func serviceInspectOperation(request *http.Request, response *http.Response, executor *operationExecutor) error {
+	// ServiceInspect response is a JSON object
+	// https://docs.docker.com/engine/api/v1.28/#operation/ServiceInspect
+	responseObject, err := getResponseAsJSONOBject(response)
+	if err != nil {
+		return err
+	}
+
+	if responseObject[serviceIdentifier] == nil {
+		return ErrDockerServiceIdentifierNotFound
+	}
+	serviceID := responseObject[serviceIdentifier].(string)
+
+	resourceControl := getResourceControlByResourceID(serviceID, executor.operationContext.resourceControls)
+	if resourceControl != nil {
+		if executor.operationContext.isAdmin || canUserAccessResource(executor.operationContext.userID, executor.operationContext.userTeamIDs, resourceControl) {
+			responseObject = decorateObject(responseObject, resourceControl)
+		} else {
+			return rewriteAccessDeniedResponse(response)
+		}
+	}
+
+	return rewriteResponse(response, responseObject, http.StatusOK)
+}
@@ -0,0 +1,43 @@
+package proxy
+
+// unixSocketHandler represents a handler to proxy HTTP requests via a unix:// socket
+import (
+	"io"
+	"net/http"
+
+	httperror "github.com/portainer/portainer/http/error"
+)
+
+type socketProxy struct {
+	Transport *proxyTransport
+}
+
+func (proxy *socketProxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	// Force URL/domain to http/unixsocket to be able to
+	// use http.Transport RoundTrip to do the requests via the socket
+	r.URL.Scheme = "http"
+	r.URL.Host = "unixsocket"
+
+	res, err := proxy.Transport.proxyDockerRequest(r)
+	if err != nil {
+		code := http.StatusInternalServerError
+		if res != nil && res.StatusCode != 0 {
+			code = res.StatusCode
+		}
+		httperror.WriteErrorResponse(w, err, code, nil)
+		return
+	}
+	defer res.Body.Close()
+
+	for k, vv := range res.Header {
+		for _, v := range vv {
+			w.Header().Add(k, v)
+		}
+	}
+
+	w.WriteHeader(res.StatusCode)
+
+	if _, err := io.Copy(w, res.Body); err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, nil)
+	}
+}
@@ -0,0 +1,36 @@
+package proxy
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer"
+)
+
+const (
+	// ErrDockerTaskServiceIdentifierNotFound defines an error raised when Portainer is unable to find the service identifier associated to a task
+	ErrDockerTaskServiceIdentifierNotFound = portainer.Error("Docker task service identifier not found")
+	taskServiceIdentifier                  = "ServiceID"
+)
+
+// taskListOperation extracts the response as a JSON object, loop through the tasks array
+// and filter the tasks based on resource controls before rewriting the response
+func taskListOperation(request *http.Request, response *http.Response, executor *operationExecutor) error {
+	var err error
+
+	// TaskList response is a JSON array
+	// https://docs.docker.com/engine/api/v1.28/#operation/TaskList
+	responseArray, err := getResponseAsJSONArray(response)
+	if err != nil {
+		return err
+	}
+
+	if !executor.operationContext.isAdmin {
+		responseArray, err = filterTaskList(responseArray, executor.operationContext.resourceControls,
+			executor.operationContext.userID, executor.operationContext.userTeamIDs)
+		if err != nil {
+			return err
+		}
+	}
+
+	return rewriteResponse(response, responseArray, http.StatusOK)
+}
@@ -0,0 +1,349 @@
+package proxy
+
+import (
+	"net"
+	"net/http"
+	"path"
+	"strings"
+
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/http/security"
+)
+
+type (
+	proxyTransport struct {
+		dockerTransport        *http.Transport
+		ResourceControlService portainer.ResourceControlService
+		TeamMembershipService  portainer.TeamMembershipService
+		SettingsService        portainer.SettingsService
+	}
+	restrictedOperationContext struct {
+		isAdmin          bool
+		userID           portainer.UserID
+		userTeamIDs      []portainer.TeamID
+		resourceControls []portainer.ResourceControl
+	}
+	operationExecutor struct {
+		operationContext *restrictedOperationContext
+		labelBlackList   []portainer.Pair
+	}
+	restrictedOperationRequest func(*http.Request, *http.Response, *operationExecutor) error
+)
+
+func newSocketTransport(socketPath string) *http.Transport {
+	return &http.Transport{
+		Dial: func(proto, addr string) (conn net.Conn, err error) {
+			return net.Dial("unix", socketPath)
+		},
+	}
+}
+
+func newHTTPTransport() *http.Transport {
+	return &http.Transport{}
+}
+
+func (p *proxyTransport) RoundTrip(request *http.Request) (*http.Response, error) {
+	return p.proxyDockerRequest(request)
+}
+
+func (p *proxyTransport) executeDockerRequest(request *http.Request) (*http.Response, error) {
+	return p.dockerTransport.RoundTrip(request)
+}
+
+func (p *proxyTransport) proxyDockerRequest(request *http.Request) (*http.Response, error) {
+	path := request.URL.Path
+
+	switch {
+	case strings.HasPrefix(path, "/containers"):
+		return p.proxyContainerRequest(request)
+	case strings.HasPrefix(path, "/services"):
+		return p.proxyServiceRequest(request)
+	case strings.HasPrefix(path, "/volumes"):
+		return p.proxyVolumeRequest(request)
+	case strings.HasPrefix(path, "/networks"):
+		return p.proxyNetworkRequest(request)
+	case strings.HasPrefix(path, "/secrets"):
+		return p.proxySecretRequest(request)
+	case strings.HasPrefix(path, "/swarm"):
+		return p.proxySwarmRequest(request)
+	case strings.HasPrefix(path, "/nodes"):
+		return p.proxyNodeRequest(request)
+	case strings.HasPrefix(path, "/tasks"):
+		return p.proxyTaskRequest(request)
+	default:
+		return p.executeDockerRequest(request)
+	}
+}
+
+func (p *proxyTransport) proxyContainerRequest(request *http.Request) (*http.Response, error) {
+	switch requestPath := request.URL.Path; requestPath {
+	case "/containers/create":
+		return p.executeDockerRequest(request)
+
+	case "/containers/prune":
+		return p.administratorOperation(request)
+
+	case "/containers/json":
+		return p.rewriteOperationWithLabelFiltering(request, containerListOperation)
+
+	default:
+		// This section assumes /containers/**
+		if match, _ := path.Match("/containers/*/*", requestPath); match {
+			// Handle /containers/{id}/{action} requests
+			containerID := path.Base(path.Dir(requestPath))
+			action := path.Base(requestPath)
+
+			if action == "json" {
+				return p.rewriteOperation(request, containerInspectOperation)
+			}
+			return p.restrictedOperation(request, containerID)
+		} else if match, _ := path.Match("/containers/*", requestPath); match {
+			// Handle /containers/{id} requests
+			containerID := path.Base(requestPath)
+			return p.restrictedOperation(request, containerID)
+		}
+		return p.executeDockerRequest(request)
+	}
+}
+
+func (p *proxyTransport) proxyServiceRequest(request *http.Request) (*http.Response, error) {
+	switch requestPath := request.URL.Path; requestPath {
+	case "/services/create":
+		return p.executeDockerRequest(request)
+
+	case "/services":
+		return p.rewriteOperation(request, serviceListOperation)
+
+	default:
+		// This section assumes /services/**
+		if match, _ := path.Match("/services/*/*", requestPath); match {
+			// Handle /services/{id}/{action} requests
+			serviceID := path.Base(path.Dir(requestPath))
+			return p.restrictedOperation(request, serviceID)
+		} else if match, _ := path.Match("/services/*", requestPath); match {
+			// Handle /services/{id} requests
+			serviceID := path.Base(requestPath)
+
+			if request.Method == http.MethodGet {
+				return p.rewriteOperation(request, serviceInspectOperation)
+			}
+			return p.restrictedOperation(request, serviceID)
+		}
+		return p.executeDockerRequest(request)
+	}
+}
+
+func (p *proxyTransport) proxyVolumeRequest(request *http.Request) (*http.Response, error) {
+	switch requestPath := request.URL.Path; requestPath {
+	case "/volumes/create":
+		return p.executeDockerRequest(request)
+
+	case "/volumes/prune":
+		return p.administratorOperation(request)
+
+	case "/volumes":
+		return p.rewriteOperation(request, volumeListOperation)
+
+	default:
+		// assume /volumes/{name}
+		if request.Method == http.MethodGet {
+			return p.rewriteOperation(request, volumeInspectOperation)
+		}
+		volumeID := path.Base(requestPath)
+		return p.restrictedOperation(request, volumeID)
+	}
+}
+
+func (p *proxyTransport) proxyNetworkRequest(request *http.Request) (*http.Response, error) {
+	switch requestPath := request.URL.Path; requestPath {
+	case "/networks/create":
+		return p.executeDockerRequest(request)
+
+	case "/networks":
+		return p.rewriteOperation(request, networkListOperation)
+
+	default:
+		// assume /networks/{id}
+		if request.Method == http.MethodGet {
+			return p.rewriteOperation(request, networkInspectOperation)
+		}
+		networkID := path.Base(requestPath)
+		return p.restrictedOperation(request, networkID)
+	}
+}
+
+func (p *proxyTransport) proxySecretRequest(request *http.Request) (*http.Response, error) {
+	switch requestPath := request.URL.Path; requestPath {
+	case "/secrets/create":
+		return p.executeDockerRequest(request)
+
+	case "/secrets":
+		return p.rewriteOperation(request, secretListOperation)
+
+	default:
+		// assume /secrets/{id}
+		if request.Method == http.MethodGet {
+			return p.rewriteOperation(request, secretInspectOperation)
+		}
+		secretID := path.Base(requestPath)
+		return p.restrictedOperation(request, secretID)
+	}
+}
+
+func (p *proxyTransport) proxyNodeRequest(request *http.Request) (*http.Response, error) {
+	requestPath := request.URL.Path
+
+	// assume /nodes/{id}
+	if path.Base(requestPath) != "nodes" {
+		return p.administratorOperation(request)
+	}
+
+	return p.executeDockerRequest(request)
+}
+
+func (p *proxyTransport) proxySwarmRequest(request *http.Request) (*http.Response, error) {
+	return p.administratorOperation(request)
+}
+
+func (p *proxyTransport) proxyTaskRequest(request *http.Request) (*http.Response, error) {
+	switch requestPath := request.URL.Path; requestPath {
+	case "/tasks":
+		return p.rewriteOperation(request, taskListOperation)
+	default:
+		// assume /tasks/{id}
+		return p.executeDockerRequest(request)
+	}
+}
+
+// restrictedOperation ensures that the current user has the required authorizations
+// before executing the original request.
+func (p *proxyTransport) restrictedOperation(request *http.Request, resourceID string) (*http.Response, error) {
+	var err error
+	tokenData, err := security.RetrieveTokenData(request)
+	if err != nil {
+		return nil, err
+	}
+
+	if tokenData.Role != portainer.AdministratorRole {
+
+		teamMemberships, err := p.TeamMembershipService.TeamMembershipsByUserID(tokenData.ID)
+		if err != nil {
+			return nil, err
+		}
+
+		userTeamIDs := make([]portainer.TeamID, 0)
+		for _, membership := range teamMemberships {
+			userTeamIDs = append(userTeamIDs, membership.TeamID)
+		}
+
+		resourceControls, err := p.ResourceControlService.ResourceControls()
+		if err != nil {
+			return nil, err
+		}
+
+		resourceControl := getResourceControlByResourceID(resourceID, resourceControls)
+		if resourceControl != nil && !canUserAccessResource(tokenData.ID, userTeamIDs, resourceControl) {
+			return writeAccessDeniedResponse()
+		}
+	}
+
+	return p.executeDockerRequest(request)
+}
+
+// rewriteOperation will create a new operation context with data that will be used
+// to decorate the original request's response as well as retrieve all the black listed labels
+// to filter the resources.
+func (p *proxyTransport) rewriteOperationWithLabelFiltering(request *http.Request, operation restrictedOperationRequest) (*http.Response, error) {
+	operationContext, err := p.createOperationContext(request)
+	if err != nil {
+		return nil, err
+	}
+
+	settings, err := p.SettingsService.Settings()
+	if err != nil {
+		return nil, err
+	}
+
+	executor := &operationExecutor{
+		operationContext: operationContext,
+		labelBlackList:   settings.BlackListedLabels,
+	}
+
+	return p.executeRequestAndRewriteResponse(request, operation, executor)
+}
+
+// rewriteOperation will create a new operation context with data that will be used
+// to decorate the original request's response.
+func (p *proxyTransport) rewriteOperation(request *http.Request, operation restrictedOperationRequest) (*http.Response, error) {
+	operationContext, err := p.createOperationContext(request)
+	if err != nil {
+		return nil, err
+	}
+
+	executor := &operationExecutor{
+		operationContext: operationContext,
+	}
+
+	return p.executeRequestAndRewriteResponse(request, operation, executor)
+}
+
+func (p *proxyTransport) executeRequestAndRewriteResponse(request *http.Request, operation restrictedOperationRequest, executor *operationExecutor) (*http.Response, error) {
+	response, err := p.executeDockerRequest(request)
+	if err != nil {
+		return response, err
+	}
+
+	err = operation(request, response, executor)
+	return response, err
+}
+
+// administratorOperation ensures that the user has administrator privileges
+// before executing the original request.
+func (p *proxyTransport) administratorOperation(request *http.Request) (*http.Response, error) {
+	tokenData, err := security.RetrieveTokenData(request)
+	if err != nil {
+		return nil, err
+	}
+
+	if tokenData.Role != portainer.AdministratorRole {
+		return writeAccessDeniedResponse()
+	}
+
+	return p.executeDockerRequest(request)
+}
+
+func (p *proxyTransport) createOperationContext(request *http.Request) (*restrictedOperationContext, error) {
+	var err error
+	tokenData, err := security.RetrieveTokenData(request)
+	if err != nil {
+		return nil, err
+	}
+
+	resourceControls, err := p.ResourceControlService.ResourceControls()
+	if err != nil {
+		return nil, err
+	}
+
+	operationContext := &restrictedOperationContext{
+		isAdmin:          true,
+		userID:           tokenData.ID,
+		resourceControls: resourceControls,
+	}
+
+	if tokenData.Role != portainer.AdministratorRole {
+		operationContext.isAdmin = false
+
+		teamMemberships, err := p.TeamMembershipService.TeamMembershipsByUserID(tokenData.ID)
+		if err != nil {
+			return nil, err
+		}
+
+		userTeamIDs := make([]portainer.TeamID, 0)
+		for _, membership := range teamMemberships {
+			userTeamIDs = append(userTeamIDs, membership.TeamID)
+		}
+		operationContext.userTeamIDs = userTeamIDs
+	}
+
+	return operationContext, nil
+}
@@ -0,0 +1,32 @@
+package proxy
+
+import "github.com/portainer/portainer"
+
+func getResourceControlByResourceID(resourceID string, resourceControls []portainer.ResourceControl) *portainer.ResourceControl {
+	for _, resourceControl := range resourceControls {
+		if resourceID == resourceControl.ResourceID {
+			return &resourceControl
+		}
+		for _, subResourceID := range resourceControl.SubResourceIDs {
+			if resourceID == subResourceID {
+				return &resourceControl
+			}
+		}
+	}
+	return nil
+}
+
+func containerHasBlackListedLabel(containerLabels map[string]interface{}, labelBlackList []portainer.Pair) bool {
+	for key, value := range containerLabels {
+		labelName := key
+		labelValue := value.(string)
+
+		for _, blackListedLabel := range labelBlackList {
+			if blackListedLabel.Name == labelName && blackListedLabel.Value == labelValue {
+				return true
+			}
+		}
+	}
+
+	return false
+}
@@ -0,0 +1,73 @@
+package proxy
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer"
+)
+
+const (
+	// ErrDockerVolumeIdentifierNotFound defines an error raised when Portainer is unable to find a volume identifier
+	ErrDockerVolumeIdentifierNotFound = portainer.Error("Docker volume identifier not found")
+	volumeIdentifier                  = "Name"
+)
+
+// volumeListOperation extracts the response as a JSON object, loop through the volume array
+// decorate and/or filter the volumes based on resource controls before rewriting the response
+func volumeListOperation(request *http.Request, response *http.Response, executor *operationExecutor) error {
+	var err error
+	// VolumeList response is a JSON object
+	// https://docs.docker.com/engine/api/v1.28/#operation/VolumeList
+	responseObject, err := getResponseAsJSONOBject(response)
+	if err != nil {
+		return err
+	}
+
+	// The "Volumes" field contains the list of volumes as an array of JSON objects
+	// Response schema reference: https://docs.docker.com/engine/api/v1.28/#operation/VolumeList
+	if responseObject["Volumes"] != nil {
+		volumeData := responseObject["Volumes"].([]interface{})
+
+		if executor.operationContext.isAdmin {
+			volumeData, err = decorateVolumeList(volumeData, executor.operationContext.resourceControls)
+		} else {
+			volumeData, err = filterVolumeList(volumeData, executor.operationContext.resourceControls, executor.operationContext.userID, executor.operationContext.userTeamIDs)
+		}
+		if err != nil {
+			return err
+		}
+
+		// Overwrite the original volume list
+		responseObject["Volumes"] = volumeData
+	}
+
+	return rewriteResponse(response, responseObject, http.StatusOK)
+}
+
+// volumeInspectOperation extracts the response as a JSON object, verify that the user
+// has access to the volume based on resource control and either rewrite an access denied response
+// or a decorated volume.
+func volumeInspectOperation(request *http.Request, response *http.Response, executor *operationExecutor) error {
+	// VolumeInspect response is a JSON object
+	// https://docs.docker.com/engine/api/v1.28/#operation/VolumeInspect
+	responseObject, err := getResponseAsJSONOBject(response)
+	if err != nil {
+		return err
+	}
+
+	if responseObject[volumeIdentifier] == nil {
+		return ErrDockerVolumeIdentifierNotFound
+	}
+	volumeID := responseObject[volumeIdentifier].(string)
+
+	resourceControl := getResourceControlByResourceID(volumeID, executor.operationContext.resourceControls)
+	if resourceControl != nil {
+		if executor.operationContext.isAdmin || canUserAccessResource(executor.operationContext.userID, executor.operationContext.userTeamIDs, resourceControl) {
+			responseObject = decorateObject(responseObject, resourceControl)
+		} else {
+			return rewriteAccessDeniedResponse(response)
+		}
+	}
+
+	return rewriteResponse(response, responseObject, http.StatusOK)
+}
@@ -1,664 +0,0 @@
-package http
-
-import (
-	"bytes"
-	"encoding/json"
-	"io/ioutil"
-	"net/http"
-	"path"
-	"strconv"
-	"strings"
-
-	"github.com/portainer/portainer"
-)
-
-type (
-	proxyTransport struct {
-		transport              *http.Transport
-		ResourceControlService portainer.ResourceControlService
-	}
-	resourceControlMetadata struct {
-		OwnerID portainer.UserID `json:"OwnerId"`
-	}
-)
-
-func (p *proxyTransport) RoundTrip(req *http.Request) (*http.Response, error) {
-	response, err := p.transport.RoundTrip(req)
-	if err != nil {
-		return response, err
-	}
-
-	err = p.proxyDockerRequests(req, response)
-	return response, err
-}
-
-func (p *proxyTransport) proxyDockerRequests(request *http.Request, response *http.Response) error {
-	path := request.URL.Path
-
-	if strings.HasPrefix(path, "/containers") {
-		return p.handleContainerRequests(request, response)
-	} else if strings.HasPrefix(path, "/services") {
-		return p.handleServiceRequests(request, response)
-	} else if strings.HasPrefix(path, "/volumes") {
-		return p.handleVolumeRequests(request, response)
-	}
-
-	return nil
-}
-
-func (p *proxyTransport) handleContainerRequests(request *http.Request, response *http.Response) error {
-	requestPath := request.URL.Path
-
-	tokenData, err := extractTokenDataFromRequestContext(request)
-	if err != nil {
-		return err
-	}
-
-	if requestPath == "/containers/prune" && tokenData.Role != portainer.AdministratorRole {
-		return writeAccessDeniedResponse(response)
-	}
-	if requestPath == "/containers/json" {
-		if tokenData.Role == portainer.AdministratorRole {
-			return p.decorateContainerResponse(response)
-		}
-		return p.proxyContainerResponseWithResourceControl(response, tokenData.ID)
-	}
-	// /containers/{id}/action
-	if match, _ := path.Match("/containers/*/*", requestPath); match {
-		if tokenData.Role != portainer.AdministratorRole {
-			resourceID := path.Base(path.Dir(requestPath))
-			return p.proxyContainerResponseWithAccessControl(response, tokenData.ID, resourceID)
-		}
-	}
-
-	return nil
-}
-
-func (p *proxyTransport) handleServiceRequests(request *http.Request, response *http.Response) error {
-	requestPath := request.URL.Path
-
-	tokenData, err := extractTokenDataFromRequestContext(request)
-	if err != nil {
-		return err
-	}
-
-	if requestPath == "/services" {
-		if tokenData.Role == portainer.AdministratorRole {
-			return p.decorateServiceResponse(response)
-		}
-		return p.proxyServiceResponseWithResourceControl(response, tokenData.ID)
-	}
-	// /services/{id}
-	if match, _ := path.Match("/services/*", requestPath); match {
-		if tokenData.Role != portainer.AdministratorRole {
-			resourceID := path.Base(requestPath)
-			return p.proxyServiceResponseWithAccessControl(response, tokenData.ID, resourceID)
-		}
-	}
-	// /services/{id}/action
-	if match, _ := path.Match("/services/*/*", requestPath); match {
-		if tokenData.Role != portainer.AdministratorRole {
-			resourceID := path.Base(path.Dir(requestPath))
-			return p.proxyServiceResponseWithAccessControl(response, tokenData.ID, resourceID)
-		}
-	}
-
-	return nil
-}
-
-func (p *proxyTransport) handleVolumeRequests(request *http.Request, response *http.Response) error {
-	requestPath := request.URL.Path
-
-	tokenData, err := extractTokenDataFromRequestContext(request)
-	if err != nil {
-		return err
-	}
-
-	if requestPath == "/volumes" {
-		if tokenData.Role == portainer.AdministratorRole {
-			return p.decorateVolumeResponse(response)
-		}
-		return p.proxyVolumeResponseWithResourceControl(response, tokenData.ID)
-	}
-	if requestPath == "/volumes/prune" && tokenData.Role != portainer.AdministratorRole {
-		return writeAccessDeniedResponse(response)
-	}
-	// /volumes/{name}
-	if match, _ := path.Match("/volumes/*", requestPath); match {
-		if tokenData.Role != portainer.AdministratorRole {
-			resourceID := path.Base(requestPath)
-			return p.proxyVolumeResponseWithAccessControl(response, tokenData.ID, resourceID)
-		}
-	}
-	return nil
-}
-
-func (p *proxyTransport) proxyContainerResponseWithAccessControl(response *http.Response, userID portainer.UserID, resourceID string) error {
-	rcs, err := p.ResourceControlService.ResourceControls(portainer.ContainerResourceControl)
-	if err != nil {
-		return err
-	}
-
-	userOwnedResources, err := getResourceIDsOwnedByUser(userID, rcs)
-	if err != nil {
-		return err
-	}
-
-	if !isStringInArray(resourceID, userOwnedResources) && isResourceIDInRCs(resourceID, rcs) {
-		return writeAccessDeniedResponse(response)
-	}
-
-	return nil
-}
-
-func (p *proxyTransport) proxyServiceResponseWithAccessControl(response *http.Response, userID portainer.UserID, resourceID string) error {
-	rcs, err := p.ResourceControlService.ResourceControls(portainer.ServiceResourceControl)
-	if err != nil {
-		return err
-	}
-
-	userOwnedResources, err := getResourceIDsOwnedByUser(userID, rcs)
-	if err != nil {
-		return err
-	}
-
-	if !isStringInArray(resourceID, userOwnedResources) && isResourceIDInRCs(resourceID, rcs) {
-		return writeAccessDeniedResponse(response)
-	}
-	return nil
-}
-
-func (p *proxyTransport) proxyVolumeResponseWithAccessControl(response *http.Response, userID portainer.UserID, resourceID string) error {
-	rcs, err := p.ResourceControlService.ResourceControls(portainer.VolumeResourceControl)
-	if err != nil {
-		return err
-	}
-
-	userOwnedResources, err := getResourceIDsOwnedByUser(userID, rcs)
-	if err != nil {
-		return err
-	}
-
-	if !isStringInArray(resourceID, userOwnedResources) && isResourceIDInRCs(resourceID, rcs) {
-		return writeAccessDeniedResponse(response)
-	}
-	return nil
-}
-
-func (p *proxyTransport) decorateContainerResponse(response *http.Response) error {
-	responseData, err := getResponseData(response)
-	if err != nil {
-		return err
-	}
-
-	containers, err := p.decorateContainers(responseData)
-	if err != nil {
-		return err
-	}
-
-	err = rewriteContainerResponse(response, containers)
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (p *proxyTransport) proxyContainerResponseWithResourceControl(response *http.Response, userID portainer.UserID) error {
-	responseData, err := getResponseData(response)
-	if err != nil {
-		return err
-	}
-
-	containers, err := p.filterContainers(userID, responseData)
-	if err != nil {
-		return err
-	}
-
-	err = rewriteContainerResponse(response, containers)
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (p *proxyTransport) decorateServiceResponse(response *http.Response) error {
-	responseData, err := getResponseData(response)
-	if err != nil {
-		return err
-	}
-
-	services, err := p.decorateServices(responseData)
-	if err != nil {
-		return err
-	}
-
-	err = rewriteServiceResponse(response, services)
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (p *proxyTransport) proxyServiceResponseWithResourceControl(response *http.Response, userID portainer.UserID) error {
-	responseData, err := getResponseData(response)
-	if err != nil {
-		return err
-	}
-
-	volumes, err := p.filterServices(userID, responseData)
-	if err != nil {
-		return err
-	}
-
-	err = rewriteServiceResponse(response, volumes)
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (p *proxyTransport) decorateVolumeResponse(response *http.Response) error {
-	responseData, err := getResponseData(response)
-	if err != nil {
-		return err
-	}
-
-	volumes, err := p.decorateVolumes(responseData)
-	if err != nil {
-		return err
-	}
-
-	err = rewriteVolumeResponse(response, volumes)
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (p *proxyTransport) proxyVolumeResponseWithResourceControl(response *http.Response, userID portainer.UserID) error {
-	responseData, err := getResponseData(response)
-	if err != nil {
-		return err
-	}
-
-	volumes, err := p.filterVolumes(userID, responseData)
-	if err != nil {
-		return err
-	}
-
-	err = rewriteVolumeResponse(response, volumes)
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (p *proxyTransport) decorateContainers(responseData interface{}) ([]interface{}, error) {
-	responseDataArray := responseData.([]interface{})
-
-	containerRCs, err := p.ResourceControlService.ResourceControls(portainer.ContainerResourceControl)
-	if err != nil {
-		return nil, err
-	}
-
-	serviceRCs, err := p.ResourceControlService.ResourceControls(portainer.ServiceResourceControl)
-	if err != nil {
-		return nil, err
-	}
-
-	decoratedResources := make([]interface{}, 0)
-
-	for _, container := range responseDataArray {
-		jsonObject := container.(map[string]interface{})
-		containerID := jsonObject["Id"].(string)
-		containerRC := getRCByResourceID(containerID, containerRCs)
-		if containerRC != nil {
-			decoratedObject := decorateWithResourceControlMetadata(jsonObject, containerRC.OwnerID)
-			decoratedResources = append(decoratedResources, decoratedObject)
-			continue
-		}
-
-		containerLabels := jsonObject["Labels"]
-		if containerLabels != nil {
-			jsonLabels := containerLabels.(map[string]interface{})
-			serviceID := jsonLabels["com.docker.swarm.service.id"]
-			if serviceID != nil {
-				serviceRC := getRCByResourceID(serviceID.(string), serviceRCs)
-				if serviceRC != nil {
-					decoratedObject := decorateWithResourceControlMetadata(jsonObject, serviceRC.OwnerID)
-					decoratedResources = append(decoratedResources, decoratedObject)
-					continue
-				}
-			}
-		}
-		decoratedResources = append(decoratedResources, container)
-	}
-
-	return decoratedResources, nil
-}
-
-func (p *proxyTransport) filterContainers(userID portainer.UserID, responseData interface{}) ([]interface{}, error) {
-	responseDataArray := responseData.([]interface{})
-
-	containerRCs, err := p.ResourceControlService.ResourceControls(portainer.ContainerResourceControl)
-	if err != nil {
-		return nil, err
-	}
-
-	serviceRCs, err := p.ResourceControlService.ResourceControls(portainer.ServiceResourceControl)
-	if err != nil {
-		return nil, err
-	}
-
-	userOwnedContainerIDs, err := getResourceIDsOwnedByUser(userID, containerRCs)
-	if err != nil {
-		return nil, err
-	}
-
-	userOwnedServiceIDs, err := getResourceIDsOwnedByUser(userID, serviceRCs)
-	if err != nil {
-		return nil, err
-	}
-
-	publicContainers := getPublicContainers(responseDataArray, containerRCs, serviceRCs)
-
-	filteredResources := make([]interface{}, 0)
-
-	for _, container := range responseDataArray {
-		jsonObject := container.(map[string]interface{})
-		containerID := jsonObject["Id"].(string)
-		if isStringInArray(containerID, userOwnedContainerIDs) {
-			decoratedObject := decorateWithResourceControlMetadata(jsonObject, userID)
-			filteredResources = append(filteredResources, decoratedObject)
-			continue
-		}
-
-		containerLabels := jsonObject["Labels"]
-		if containerLabels != nil {
-			jsonLabels := containerLabels.(map[string]interface{})
-			serviceID := jsonLabels["com.docker.swarm.service.id"]
-			if serviceID != nil && isStringInArray(serviceID.(string), userOwnedServiceIDs) {
-				decoratedObject := decorateWithResourceControlMetadata(jsonObject, userID)
-				filteredResources = append(filteredResources, decoratedObject)
-			}
-		}
-	}
-
-	filteredResources = append(filteredResources, publicContainers...)
-	return filteredResources, nil
-}
-
-func decorateWithResourceControlMetadata(object map[string]interface{}, userID portainer.UserID) map[string]interface{} {
-	metadata := make(map[string]interface{})
-	metadata["ResourceControl"] = resourceControlMetadata{
-		OwnerID: userID,
-	}
-	object["Portainer"] = metadata
-	return object
-}
-
-func (p *proxyTransport) decorateServices(responseData interface{}) ([]interface{}, error) {
-	responseDataArray := responseData.([]interface{})
-
-	rcs, err := p.ResourceControlService.ResourceControls(portainer.ServiceResourceControl)
-	if err != nil {
-		return nil, err
-	}
-
-	decoratedResources := make([]interface{}, 0)
-
-	for _, service := range responseDataArray {
-		jsonResource := service.(map[string]interface{})
-		resourceID := jsonResource["ID"].(string)
-		serviceRC := getRCByResourceID(resourceID, rcs)
-		if serviceRC != nil {
-			decoratedObject := decorateWithResourceControlMetadata(jsonResource, serviceRC.OwnerID)
-			decoratedResources = append(decoratedResources, decoratedObject)
-			continue
-		}
-		decoratedResources = append(decoratedResources, service)
-	}
-
-	return decoratedResources, nil
-}
-
-func (p *proxyTransport) filterServices(userID portainer.UserID, responseData interface{}) ([]interface{}, error) {
-	responseDataArray := responseData.([]interface{})
-
-	rcs, err := p.ResourceControlService.ResourceControls(portainer.ServiceResourceControl)
-	if err != nil {
-		return nil, err
-	}
-
-	userOwnedServiceIDs, err := getResourceIDsOwnedByUser(userID, rcs)
-	if err != nil {
-		return nil, err
-	}
-
-	publicServices := getPublicResources(responseDataArray, rcs, "ID")
-
-	filteredResources := make([]interface{}, 0)
-
-	for _, res := range responseDataArray {
-		jsonResource := res.(map[string]interface{})
-		resourceID := jsonResource["ID"].(string)
-		if isStringInArray(resourceID, userOwnedServiceIDs) {
-			decoratedObject := decorateWithResourceControlMetadata(jsonResource, userID)
-			filteredResources = append(filteredResources, decoratedObject)
-		}
-	}
-
-	filteredResources = append(filteredResources, publicServices...)
-	return filteredResources, nil
-}
-
-func (p *proxyTransport) decorateVolumes(responseData interface{}) ([]interface{}, error) {
-	var responseDataArray []interface{}
-	jsonObject := responseData.(map[string]interface{})
-	if jsonObject["Volumes"] != nil {
-		responseDataArray = jsonObject["Volumes"].([]interface{})
-	}
-
-	rcs, err := p.ResourceControlService.ResourceControls(portainer.VolumeResourceControl)
-	if err != nil {
-		return nil, err
-	}
-
-	decoratedResources := make([]interface{}, 0)
-
-	for _, volume := range responseDataArray {
-		jsonResource := volume.(map[string]interface{})
-		resourceID := jsonResource["Name"].(string)
-		volumeRC := getRCByResourceID(resourceID, rcs)
-		if volumeRC != nil {
-			decoratedObject := decorateWithResourceControlMetadata(jsonResource, volumeRC.OwnerID)
-			decoratedResources = append(decoratedResources, decoratedObject)
-			continue
-		}
-		decoratedResources = append(decoratedResources, volume)
-	}
-
-	return decoratedResources, nil
-}
-
-func (p *proxyTransport) filterVolumes(userID portainer.UserID, responseData interface{}) ([]interface{}, error) {
-	var responseDataArray []interface{}
-	jsonObject := responseData.(map[string]interface{})
-	if jsonObject["Volumes"] != nil {
-		responseDataArray = jsonObject["Volumes"].([]interface{})
-	}
-
-	rcs, err := p.ResourceControlService.ResourceControls(portainer.VolumeResourceControl)
-	if err != nil {
-		return nil, err
-	}
-
-	userOwnedVolumeIDs, err := getResourceIDsOwnedByUser(userID, rcs)
-	if err != nil {
-		return nil, err
-	}
-
-	publicVolumes := getPublicResources(responseDataArray, rcs, "Name")
-
-	filteredResources := make([]interface{}, 0)
-
-	for _, res := range responseDataArray {
-		jsonResource := res.(map[string]interface{})
-		resourceID := jsonResource["Name"].(string)
-		if isStringInArray(resourceID, userOwnedVolumeIDs) {
-			decoratedObject := decorateWithResourceControlMetadata(jsonResource, userID)
-			filteredResources = append(filteredResources, decoratedObject)
-		}
-	}
-
-	filteredResources = append(filteredResources, publicVolumes...)
-	return filteredResources, nil
-}
-
-func getResourceIDsOwnedByUser(userID portainer.UserID, rcs []portainer.ResourceControl) ([]string, error) {
-	ownedResources := make([]string, 0)
-	for _, rc := range rcs {
-		if rc.OwnerID == userID {
-			ownedResources = append(ownedResources, rc.ResourceID)
-		}
-	}
-	return ownedResources, nil
-}
-
-func getOwnedServiceContainers(responseData []interface{}, serviceRCs []portainer.ResourceControl) []interface{} {
-	ownedContainers := make([]interface{}, 0)
-	for _, res := range responseData {
-		jsonResource := res.(map[string]map[string]interface{})
-		swarmServiceID := jsonResource["Labels"]["com.docker.swarm.service.id"]
-		if swarmServiceID != nil {
-			resourceID := swarmServiceID.(string)
-			if isResourceIDInRCs(resourceID, serviceRCs) {
-				ownedContainers = append(ownedContainers, res)
-			}
-		}
-	}
-	return ownedContainers
-}
-
-func getPublicContainers(responseData []interface{}, containerRCs []portainer.ResourceControl, serviceRCs []portainer.ResourceControl) []interface{} {
-	publicContainers := make([]interface{}, 0)
-	for _, container := range responseData {
-		jsonObject := container.(map[string]interface{})
-		containerID := jsonObject["Id"].(string)
-		if !isResourceIDInRCs(containerID, containerRCs) {
-			containerLabels := jsonObject["Labels"]
-			if containerLabels != nil {
-				jsonLabels := containerLabels.(map[string]interface{})
-				serviceID := jsonLabels["com.docker.swarm.service.id"]
-				if serviceID == nil {
-					publicContainers = append(publicContainers, container)
-				} else if serviceID != nil && !isResourceIDInRCs(serviceID.(string), serviceRCs) {
-					publicContainers = append(publicContainers, container)
-				}
-			} else {
-				publicContainers = append(publicContainers, container)
-			}
-		}
-	}
-
-	return publicContainers
-}
-
-func getPublicResources(responseData []interface{}, rcs []portainer.ResourceControl, resourceIDKey string) []interface{} {
-	publicResources := make([]interface{}, 0)
-	for _, res := range responseData {
-		jsonResource := res.(map[string]interface{})
-		resourceID := jsonResource[resourceIDKey].(string)
-		if !isResourceIDInRCs(resourceID, rcs) {
-			publicResources = append(publicResources, res)
-		}
-	}
-	return publicResources
-}
-
-func isStringInArray(target string, array []string) bool {
-	for _, element := range array {
-		if element == target {
-			return true
-		}
-	}
-	return false
-}
-
-func isResourceIDInRCs(resourceID string, rcs []portainer.ResourceControl) bool {
-	for _, rc := range rcs {
-		if resourceID == rc.ResourceID {
-			return true
-		}
-	}
-	return false
-}
-
-func getRCByResourceID(resourceID string, rcs []portainer.ResourceControl) *portainer.ResourceControl {
-	for _, rc := range rcs {
-		if resourceID == rc.ResourceID {
-			return &rc
-		}
-	}
-	return nil
-}
-
-func getResponseData(response *http.Response) (interface{}, error) {
-	var data interface{}
-	if response.Body != nil {
-		body, err := ioutil.ReadAll(response.Body)
-		if err != nil {
-			return nil, err
-		}
-
-		err = response.Body.Close()
-		if err != nil {
-			return nil, err
-		}
-
-		err = json.Unmarshal(body, &data)
-		if err != nil {
-			return nil, err
-		}
-
-		return data, nil
-	}
-	return nil, ErrEmptyResponseBody
-}
-
-func writeAccessDeniedResponse(response *http.Response) error {
-	return rewriteResponse(response, portainer.ErrResourceAccessDenied, 403)
-}
-
-func rewriteContainerResponse(response *http.Response, responseData interface{}) error {
-	return rewriteResponse(response, responseData, 200)
-}
-
-func rewriteServiceResponse(response *http.Response, responseData interface{}) error {
-	return rewriteResponse(response, responseData, 200)
-}
-
-func rewriteVolumeResponse(response *http.Response, responseData interface{}) error {
-	data := map[string]interface{}{}
-	data["Volumes"] = responseData
-	return rewriteResponse(response, data, 200)
-}
-
-func rewriteResponse(response *http.Response, newContent interface{}, statusCode int) error {
-	jsonData, err := json.Marshal(newContent)
-	if err != nil {
-		return err
-	}
-	body := ioutil.NopCloser(bytes.NewReader(jsonData))
-	response.StatusCode = statusCode
-	response.Body = body
-	response.ContentLength = int64(len(jsonData))
-	response.Header.Set("Content-Length", strconv.Itoa(len(jsonData)))
-	return nil
-}
@@ -0,0 +1,123 @@
+package security
+
+import "github.com/portainer/portainer"
+
+// AuthorizedResourceControlDeletion ensure that the user can delete a resource control object.
+// A non-administrator user cannot delete a resource control where:
+// * the AdministratorsOnly flag is set
+// * he is not one of the users in the user accesses
+// * he is not a member of any team within the team accesses
+func AuthorizedResourceControlDeletion(resourceControl *portainer.ResourceControl, context *RestrictedRequestContext) bool {
+	if context.IsAdmin {
+		return true
+	}
+
+	if resourceControl.AdministratorsOnly {
+		return false
+	}
+
+	userAccessesCount := len(resourceControl.UserAccesses)
+	teamAccessesCount := len(resourceControl.TeamAccesses)
+
+	if teamAccessesCount > 0 {
+		for _, access := range resourceControl.TeamAccesses {
+			for _, membership := range context.UserMemberships {
+				if membership.TeamID == access.TeamID {
+					return true
+				}
+			}
+		}
+	}
+
+	if userAccessesCount > 0 {
+		for _, access := range resourceControl.UserAccesses {
+			if access.UserID == context.UserID {
+				return true
+			}
+		}
+	}
+
+	return false
+}
+
+// AuthorizedResourceControlUpdate ensure that the user can update a resource control object.
+// It reuses the creation restrictions and adds extra checks.
+// A non-administrator user cannot update a resource control where:
+// * he wants to put one or more user in the user accesses
+func AuthorizedResourceControlUpdate(resourceControl *portainer.ResourceControl, context *RestrictedRequestContext) bool {
+	userAccessesCount := len(resourceControl.UserAccesses)
+	if !context.IsAdmin && userAccessesCount > 0 {
+		return false
+	}
+
+	return AuthorizedResourceControlCreation(resourceControl, context)
+}
+
+// AuthorizedResourceControlCreation ensure that the user can create a resource control object.
+// A non-administrator user cannot create a resource control where:
+// * the AdministratorsOnly flag is set
+// * he wants to add more than one user in the user accesses
+// * he wants to add a team he is not a member of
+func AuthorizedResourceControlCreation(resourceControl *portainer.ResourceControl, context *RestrictedRequestContext) bool {
+	if context.IsAdmin {
+		return true
+	}
+
+	if resourceControl.AdministratorsOnly {
+		return false
+	}
+
+	userAccessesCount := len(resourceControl.UserAccesses)
+	teamAccessesCount := len(resourceControl.TeamAccesses)
+	if userAccessesCount > 1 || (userAccessesCount == 1 && teamAccessesCount == 1) {
+		return false
+	}
+
+	if userAccessesCount == 1 {
+		access := resourceControl.UserAccesses[0]
+		if access.UserID == context.UserID {
+			return true
+		}
+	}
+
+	if teamAccessesCount > 0 {
+		for _, access := range resourceControl.TeamAccesses {
+			isMember := false
+			for _, membership := range context.UserMemberships {
+				if membership.TeamID == access.TeamID {
+					isMember = true
+				}
+			}
+			if !isMember {
+				return false
+			}
+		}
+	}
+
+	return true
+}
+
+// AuthorizedTeamManagement ensure that access to the management of the specified team is granted.
+// It will check if the user is either administrator or leader of that team.
+func AuthorizedTeamManagement(teamID portainer.TeamID, context *RestrictedRequestContext) bool {
+	if context.IsAdmin {
+		return true
+	}
+
+	for _, membership := range context.UserMemberships {
+		if membership.TeamID == teamID && membership.Role == portainer.TeamLeader {
+			return true
+		}
+	}
+
+	return false
+}
+
+// AuthorizedUserManagement ensure that access to the management of the specified user is granted.
+// It will check if the user is either administrator or the owner of the user account.
+func AuthorizedUserManagement(userID portainer.UserID, context *RestrictedRequestContext) bool {
+	if context.IsAdmin || context.UserID == userID {
+		return true
+	}
+	return false
+}
@@ -0,0 +1,176 @@
+package security
+
+import (
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+
+	"net/http"
+	"strings"
+)
+
+type (
+	// RequestBouncer represents an entity that manages API request accesses
+	RequestBouncer struct {
+		jwtService            portainer.JWTService
+		teamMembershipService portainer.TeamMembershipService
+		authDisabled          bool
+	}
+
+	// RestrictedRequestContext is a data structure containing information
+	// used in RestrictedAccess
+	RestrictedRequestContext struct {
+		IsAdmin         bool
+		IsTeamLeader    bool
+		UserID          portainer.UserID
+		UserMemberships []portainer.TeamMembership
+	}
+)
+
+// NewRequestBouncer initializes a new RequestBouncer
+func NewRequestBouncer(jwtService portainer.JWTService, teamMembershipService portainer.TeamMembershipService, authDisabled bool) *RequestBouncer {
+	return &RequestBouncer{
+		jwtService:            jwtService,
+		teamMembershipService: teamMembershipService,
+		authDisabled:          authDisabled,
+	}
+}
+
+// PublicAccess defines a security check for public endpoints.
+// No authentication is required to access these endpoints.
+func (bouncer *RequestBouncer) PublicAccess(h http.Handler) http.Handler {
+	h = mwSecureHeaders(h)
+	return h
+}
+
+// AuthenticatedAccess defines a security check for private endpoints.
+// Authentication is required to access these endpoints.
+func (bouncer *RequestBouncer) AuthenticatedAccess(h http.Handler) http.Handler {
+	h = bouncer.mwCheckAuthentication(h)
+	h = mwSecureHeaders(h)
+	return h
+}
+
+// RestrictedAccess defines a security check for restricted endpoints.
+// Authentication is required to access these endpoints.
+// The request context will be enhanced with a RestrictedRequestContext object
+// that might be used later to authorize/filter access to resources.
+func (bouncer *RequestBouncer) RestrictedAccess(h http.Handler) http.Handler {
+	h = bouncer.mwUpgradeToRestrictedRequest(h)
+	h = bouncer.AuthenticatedAccess(h)
+	return h
+}
+
+// AdministratorAccess defines a chain of middleware for restricted endpoints.
+// Authentication as well as administrator role are required to access these endpoints.
+func (bouncer *RequestBouncer) AdministratorAccess(h http.Handler) http.Handler {
+	h = mwCheckAdministratorRole(h)
+	h = bouncer.AuthenticatedAccess(h)
+	return h
+}
+
+// mwSecureHeaders provides secure headers middleware for handlers.
+func mwSecureHeaders(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Add("X-Content-Type-Options", "nosniff")
+		w.Header().Add("X-Frame-Options", "DENY")
+		next.ServeHTTP(w, r)
+	})
+}
+
+// mwUpgradeToRestrictedRequest will enhance the current request with
+// a new RestrictedRequestContext object.
+func (bouncer *RequestBouncer) mwUpgradeToRestrictedRequest(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		tokenData, err := RetrieveTokenData(r)
+		if err != nil {
+			httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, nil)
+			return
+		}
+
+		requestContext, err := bouncer.newRestrictedContextRequest(tokenData.ID, tokenData.Role)
+		if err != nil {
+			httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, nil)
+			return
+		}
+
+		ctx := storeRestrictedRequestContext(r, requestContext)
+		next.ServeHTTP(w, r.WithContext(ctx))
+	})
+}
+
+// mwCheckAdministratorRole check the role of the user associated to the request
+func mwCheckAdministratorRole(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		tokenData, err := RetrieveTokenData(r)
+		if err != nil || tokenData.Role != portainer.AdministratorRole {
+			httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, nil)
+			return
+		}
+
+		next.ServeHTTP(w, r)
+	})
+}
+
+// mwCheckAuthentication provides Authentication middleware for handlers
+func (bouncer *RequestBouncer) mwCheckAuthentication(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		var tokenData *portainer.TokenData
+		if !bouncer.authDisabled {
+			var token string
+
+			// Get token from the Authorization header
+			tokens, ok := r.Header["Authorization"]
+			if ok && len(tokens) >= 1 {
+				token = tokens[0]
+				token = strings.TrimPrefix(token, "Bearer ")
+			}
+
+			if token == "" {
+				httperror.WriteErrorResponse(w, portainer.ErrUnauthorized, http.StatusUnauthorized, nil)
+				return
+			}
+
+			var err error
+			tokenData, err = bouncer.jwtService.ParseAndVerifyToken(token)
+			if err != nil {
+				httperror.WriteErrorResponse(w, err, http.StatusUnauthorized, nil)
+				return
+			}
+		} else {
+			tokenData = &portainer.TokenData{
+				Role: portainer.AdministratorRole,
+			}
+		}
+
+		ctx := storeTokenData(r, tokenData)
+		next.ServeHTTP(w, r.WithContext(ctx))
+		return
+	})
+}
+
+func (bouncer *RequestBouncer) newRestrictedContextRequest(userID portainer.UserID, userRole portainer.UserRole) (*RestrictedRequestContext, error) {
+	requestContext := &RestrictedRequestContext{
+		IsAdmin: true,
+		UserID:  userID,
+	}
+
+	if userRole != portainer.AdministratorRole {
+		requestContext.IsAdmin = false
+		memberships, err := bouncer.teamMembershipService.TeamMembershipsByUserID(userID)
+		if err != nil {
+			return nil, err
+		}
+
+		isTeamLeader := false
+		for _, membership := range memberships {
+			if membership.Role == portainer.TeamLeader {
+				isTeamLeader = true
+			}
+		}
+
+		requestContext.IsTeamLeader = isTeamLeader
+		requestContext.UserMemberships = memberships
+	}
+
+	return requestContext, nil
+}
@@ -0,0 +1,50 @@
+package security
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/portainer/portainer"
+)
+
+type (
+	contextKey int
+)
+
+const (
+	contextAuthenticationKey contextKey = iota
+	contextRestrictedRequest
+)
+
+// storeTokenData stores a TokenData object inside the request context and returns the enhanced context.
+func storeTokenData(request *http.Request, tokenData *portainer.TokenData) context.Context {
+	return context.WithValue(request.Context(), contextAuthenticationKey, tokenData)
+}
+
+// RetrieveTokenData returns the TokenData object stored in the request context.
+func RetrieveTokenData(request *http.Request) (*portainer.TokenData, error) {
+	contextData := request.Context().Value(contextAuthenticationKey)
+	if contextData == nil {
+		return nil, portainer.ErrMissingContextData
+	}
+
+	tokenData := contextData.(*portainer.TokenData)
+	return tokenData, nil
+}
+
+// storeRestrictedRequestContext stores a RestrictedRequestContext object inside the request context
+// and returns the enhanced context.
+func storeRestrictedRequestContext(request *http.Request, requestContext *RestrictedRequestContext) context.Context {
+	return context.WithValue(request.Context(), contextRestrictedRequest, requestContext)
+}
+
+// RetrieveRestrictedRequestContext returns the RestrictedRequestContext object stored in the request context.
+func RetrieveRestrictedRequestContext(request *http.Request) (*RestrictedRequestContext, error) {
+	contextData := request.Context().Value(contextRestrictedRequest)
+	if contextData == nil {
+		return nil, portainer.ErrMissingSecurityContext
+	}
+
+	requestContext := contextData.(*RestrictedRequestContext)
+	return requestContext, nil
+}
@@ -0,0 +1,129 @@
+package security
+
+import "github.com/portainer/portainer"
+
+// FilterUserTeams filters teams based on user role.
+// non-administrator users only have access to team they are member of.
+func FilterUserTeams(teams []portainer.Team, context *RestrictedRequestContext) []portainer.Team {
+	filteredTeams := teams
+
+	if !context.IsAdmin {
+		filteredTeams = make([]portainer.Team, 0)
+		for _, membership := range context.UserMemberships {
+			for _, team := range teams {
+				if team.ID == membership.TeamID {
+					filteredTeams = append(filteredTeams, team)
+					break
+				}
+			}
+		}
+	}
+
+	return filteredTeams
+}
+
+// FilterLeaderTeams filters teams based on user role.
+// Team leaders only have access to team they lead.
+func FilterLeaderTeams(teams []portainer.Team, context *RestrictedRequestContext) []portainer.Team {
+	filteredTeams := teams
+
+	if context.IsTeamLeader {
+		filteredTeams = make([]portainer.Team, 0)
+		for _, membership := range context.UserMemberships {
+			for _, team := range teams {
+				if team.ID == membership.TeamID && membership.Role == portainer.TeamLeader {
+					filteredTeams = append(filteredTeams, team)
+					break
+				}
+			}
+		}
+	}
+
+	return filteredTeams
+}
+
+// FilterUsers filters users based on user role.
+// Non-administrator users only have access to non-administrator users.
+func FilterUsers(users []portainer.User, context *RestrictedRequestContext) []portainer.User {
+	filteredUsers := users
+
+	if !context.IsAdmin {
+		filteredUsers = make([]portainer.User, 0)
+
+		for _, user := range users {
+			if user.Role != portainer.AdministratorRole {
+				filteredUsers = append(filteredUsers, user)
+			}
+		}
+	}
+
+	return filteredUsers
+}
+
+// FilterRegistries filters registries based on user role and team memberships.
+// Non administrator users only have access to authorized endpoints.
+func FilterRegistries(registries []portainer.Registry, context *RestrictedRequestContext) ([]portainer.Registry, error) {
+
+	filteredRegistries := registries
+	if !context.IsAdmin {
+		filteredRegistries = make([]portainer.Registry, 0)
+
+		for _, registry := range registries {
+			if isRegistryAccessAuthorized(&registry, context.UserID, context.UserMemberships) {
+				filteredRegistries = append(filteredRegistries, registry)
+			}
+		}
+	}
+
+	return filteredRegistries, nil
+}
+
+// FilterEndpoints filters endpoints based on user role and team memberships.
+// Non administrator users only have access to authorized endpoints.
+func FilterEndpoints(endpoints []portainer.Endpoint, context *RestrictedRequestContext) ([]portainer.Endpoint, error) {
+	filteredEndpoints := endpoints
+
+	if !context.IsAdmin {
+		filteredEndpoints = make([]portainer.Endpoint, 0)
+
+		for _, endpoint := range endpoints {
+			if isEndpointAccessAuthorized(&endpoint, context.UserID, context.UserMemberships) {
+				filteredEndpoints = append(filteredEndpoints, endpoint)
+			}
+		}
+	}
+
+	return filteredEndpoints, nil
+}
+
+func isRegistryAccessAuthorized(registry *portainer.Registry, userID portainer.UserID, memberships []portainer.TeamMembership) bool {
+	for _, authorizedUserID := range registry.AuthorizedUsers {
+		if authorizedUserID == userID {
+			return true
+		}
+	}
+	for _, membership := range memberships {
+		for _, authorizedTeamID := range registry.AuthorizedTeams {
+			if membership.TeamID == authorizedTeamID {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func isEndpointAccessAuthorized(endpoint *portainer.Endpoint, userID portainer.UserID, memberships []portainer.TeamMembership) bool {
+	for _, authorizedUserID := range endpoint.AuthorizedUsers {
+		if authorizedUserID == userID {
+			return true
+		}
+	}
+	for _, membership := range memberships {
+		for _, authorizedTeamID := range endpoint.AuthorizedTeams {
+			if membership.TeamID == authorizedTeamID {
+				return true
+			}
+		}
+	}
+	return false
+}
@@ -2,6 +2,9 @@ package http

 import (
 	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/http/handler"
+	"github.com/portainer/portainer/http/proxy"
+	"github.com/portainer/portainer/http/security"

 	"net/http"
 )
@@ -12,60 +15,95 @@ type Server struct {
 	AssetsPath             string
 	AuthDisabled           bool
 	EndpointManagement     bool
+	Status                 *portainer.Status
 	UserService            portainer.UserService
+	TeamService            portainer.TeamService
+	TeamMembershipService  portainer.TeamMembershipService
 	EndpointService        portainer.EndpointService
 	ResourceControlService portainer.ResourceControlService
+	SettingsService        portainer.SettingsService
 	CryptoService          portainer.CryptoService
 	JWTService             portainer.JWTService
 	FileService            portainer.FileService
-	Settings               *portainer.Settings
-	TemplatesURL           string
-	Handler                *Handler
+	RegistryService        portainer.RegistryService
+	DockerHubService       portainer.DockerHubService
+	LDAPService            portainer.LDAPService
+	Handler                *handler.Handler
+	SSL                    bool
+	SSLCert                string
+	SSLKey                 string
 }

 // Start starts the HTTP server
 func (server *Server) Start() error {
-	middleWareService := &middleWareService{
-		jwtService:   server.JWTService,
-		authDisabled: server.AuthDisabled,
-	}
+	requestBouncer := security.NewRequestBouncer(server.JWTService, server.TeamMembershipService, server.AuthDisabled)
+	proxyManager := proxy.NewManager(server.ResourceControlService, server.TeamMembershipService, server.SettingsService)

-	var authHandler = NewAuthHandler(middleWareService)
+	var authHandler = handler.NewAuthHandler(requestBouncer, server.AuthDisabled)
 	authHandler.UserService = server.UserService
 	authHandler.CryptoService = server.CryptoService
 	authHandler.JWTService = server.JWTService
-	authHandler.authDisabled = server.AuthDisabled
-	var userHandler = NewUserHandler(middleWareService)
+	authHandler.LDAPService = server.LDAPService
+	authHandler.SettingsService = server.SettingsService
+	var userHandler = handler.NewUserHandler(requestBouncer)
 	userHandler.UserService = server.UserService
+	userHandler.TeamService = server.TeamService
+	userHandler.TeamMembershipService = server.TeamMembershipService
 	userHandler.CryptoService = server.CryptoService
 	userHandler.ResourceControlService = server.ResourceControlService
-	var settingsHandler = NewSettingsHandler(middleWareService)
-	settingsHandler.settings = server.Settings
-	var templatesHandler = NewTemplatesHandler(middleWareService)
-	templatesHandler.containerTemplatesURL = server.TemplatesURL
-	var dockerHandler = NewDockerHandler(middleWareService, server.ResourceControlService)
+	userHandler.SettingsService = server.SettingsService
+	var teamHandler = handler.NewTeamHandler(requestBouncer)
+	teamHandler.TeamService = server.TeamService
+	teamHandler.TeamMembershipService = server.TeamMembershipService
+	var teamMembershipHandler = handler.NewTeamMembershipHandler(requestBouncer)
+	teamMembershipHandler.TeamMembershipService = server.TeamMembershipService
+	var statusHandler = handler.NewStatusHandler(requestBouncer, server.Status)
+	var settingsHandler = handler.NewSettingsHandler(requestBouncer)
+	settingsHandler.SettingsService = server.SettingsService
+	settingsHandler.LDAPService = server.LDAPService
+	settingsHandler.FileService = server.FileService
+	var templatesHandler = handler.NewTemplatesHandler(requestBouncer)
+	templatesHandler.SettingsService = server.SettingsService
+	var dockerHandler = handler.NewDockerHandler(requestBouncer)
 	dockerHandler.EndpointService = server.EndpointService
-	var websocketHandler = NewWebSocketHandler()
+	dockerHandler.TeamMembershipService = server.TeamMembershipService
+	dockerHandler.ProxyManager = proxyManager
+	var websocketHandler = handler.NewWebSocketHandler()
 	websocketHandler.EndpointService = server.EndpointService
-	var endpointHandler = NewEndpointHandler(middleWareService)
-	endpointHandler.authorizeEndpointManagement = server.EndpointManagement
+	var endpointHandler = handler.NewEndpointHandler(requestBouncer, server.EndpointManagement)
 	endpointHandler.EndpointService = server.EndpointService
 	endpointHandler.FileService = server.FileService
-	var uploadHandler = NewUploadHandler(middleWareService)
+	endpointHandler.ProxyManager = proxyManager
+	var registryHandler = handler.NewRegistryHandler(requestBouncer)
+	registryHandler.RegistryService = server.RegistryService
+	var dockerHubHandler = handler.NewDockerHubHandler(requestBouncer)
+	dockerHubHandler.DockerHubService = server.DockerHubService
+	var resourceHandler = handler.NewResourceHandler(requestBouncer)
+	resourceHandler.ResourceControlService = server.ResourceControlService
+	var uploadHandler = handler.NewUploadHandler(requestBouncer)
 	uploadHandler.FileService = server.FileService
-	var fileHandler = newFileHandler(server.AssetsPath)
+	var fileHandler = handler.NewFileHandler(server.AssetsPath)

-	server.Handler = &Handler{
-		AuthHandler:      authHandler,
-		UserHandler:      userHandler,
-		EndpointHandler:  endpointHandler,
-		SettingsHandler:  settingsHandler,
-		TemplatesHandler: templatesHandler,
-		DockerHandler:    dockerHandler,
-		WebSocketHandler: websocketHandler,
-		FileHandler:      fileHandler,
-		UploadHandler:    uploadHandler,
+	server.Handler = &handler.Handler{
+		AuthHandler:           authHandler,
+		UserHandler:           userHandler,
+		TeamHandler:           teamHandler,
+		TeamMembershipHandler: teamMembershipHandler,
+		EndpointHandler:       endpointHandler,
+		RegistryHandler:       registryHandler,
+		DockerHubHandler:      dockerHubHandler,
+		ResourceHandler:       resourceHandler,
+		SettingsHandler:       settingsHandler,
+		StatusHandler:         statusHandler,
+		TemplatesHandler:      templatesHandler,
+		DockerHandler:         dockerHandler,
+		WebSocketHandler:      websocketHandler,
+		FileHandler:           fileHandler,
+		UploadHandler:         uploadHandler,
 	}

+	if server.SSL {
+		return http.ListenAndServeTLS(server.BindAddress, server.SSLCert, server.SSLKey, server.Handler)
+	}
 	return http.ListenAndServe(server.BindAddress, server.Handler)
 }
@@ -1,40 +0,0 @@
-package http
-
-import (
-	"github.com/portainer/portainer"
-
-	"log"
-	"net/http"
-	"os"
-
-	"github.com/gorilla/mux"
-)
-
-// SettingsHandler represents an HTTP API handler for managing settings.
-type SettingsHandler struct {
-	*mux.Router
-	Logger   *log.Logger
-	settings *portainer.Settings
-}
-
-// NewSettingsHandler returns a new instance of SettingsHandler.
-func NewSettingsHandler(mw *middleWareService) *SettingsHandler {
-	h := &SettingsHandler{
-		Router: mux.NewRouter(),
-		Logger: log.New(os.Stderr, "", log.LstdFlags),
-	}
-	h.Handle("/settings",
-		mw.public(http.HandlerFunc(h.handleGetSettings)))
-
-	return h
-}
-
-// handleGetSettings handles GET requests on /settings
-func (handler *SettingsHandler) handleGetSettings(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		handleNotAllowed(w, []string{http.MethodGet})
-		return
-	}
-
-	encodeJSON(w, handler.settings, handler.Logger)
-}
@@ -1,70 +0,0 @@
-package http
-
-import (
-	"io/ioutil"
-	"log"
-	"net/http"
-	"os"
-
-	"github.com/gorilla/mux"
-)
-
-// TemplatesHandler represents an HTTP API handler for managing templates.
-type TemplatesHandler struct {
-	*mux.Router
-	Logger                *log.Logger
-	containerTemplatesURL string
-}
-
-const (
-	containerTemplatesURLLinuxServerIo = "http://tools.linuxserver.io/portainer.json"
-)
-
-// NewTemplatesHandler returns a new instance of TemplatesHandler.
-func NewTemplatesHandler(mw *middleWareService) *TemplatesHandler {
-	h := &TemplatesHandler{
-		Router: mux.NewRouter(),
-		Logger: log.New(os.Stderr, "", log.LstdFlags),
-	}
-	h.Handle("/templates",
-		mw.authenticated(http.HandlerFunc(h.handleGetTemplates)))
-	return h
-}
-
-// handleGetTemplates handles GET requests on /templates?key=<key>
-func (handler *TemplatesHandler) handleGetTemplates(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		handleNotAllowed(w, []string{http.MethodGet})
-		return
-	}
-
-	key := r.FormValue("key")
-	if key == "" {
-		Error(w, ErrInvalidQueryFormat, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	var templatesURL string
-	if key == "containers" {
-		templatesURL = handler.containerTemplatesURL
-	} else if key == "linuxserver.io" {
-		templatesURL = containerTemplatesURLLinuxServerIo
-	} else {
-		Error(w, ErrInvalidQueryFormat, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	resp, err := http.Get(templatesURL)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-	defer resp.Body.Close()
-	body, err := ioutil.ReadAll(resp.Body)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-	w.Header().Set("Content-Type", "application/json")
-	w.Write(body)
-}
@@ -1,26 +0,0 @@
-package http
-
-import (
-	"crypto/tls"
-	"crypto/x509"
-	"io/ioutil"
-)
-
-// createTLSConfiguration initializes a tls.Config using a CA certificate, a certificate and a key
-func createTLSConfiguration(caCertPath, certPath, keyPath string) (*tls.Config, error) {
-	cert, err := tls.LoadX509KeyPair(certPath, keyPath)
-	if err != nil {
-		return nil, err
-	}
-	caCert, err := ioutil.ReadFile(caCertPath)
-	if err != nil {
-		return nil, err
-	}
-	caCertPool := x509.NewCertPool()
-	caCertPool.AppendCertsFromPEM(caCert)
-	config := &tls.Config{
-		Certificates: []tls.Certificate{cert},
-		RootCAs:      caCertPool,
-	}
-	return config, nil
-}
@@ -1,480 +0,0 @@
-package http
-
-import (
-	"strconv"
-
-	"github.com/portainer/portainer"
-
-	"encoding/json"
-	"log"
-	"net/http"
-	"os"
-
-	"github.com/asaskevich/govalidator"
-	"github.com/gorilla/mux"
-)
-
-// UserHandler represents an HTTP API handler for managing users.
-type UserHandler struct {
-	*mux.Router
-	Logger                 *log.Logger
-	UserService            portainer.UserService
-	ResourceControlService portainer.ResourceControlService
-	CryptoService          portainer.CryptoService
-}
-
-// NewUserHandler returns a new instance of UserHandler.
-func NewUserHandler(mw *middleWareService) *UserHandler {
-	h := &UserHandler{
-		Router: mux.NewRouter(),
-		Logger: log.New(os.Stderr, "", log.LstdFlags),
-	}
-	h.Handle("/users",
-		mw.administrator(http.HandlerFunc(h.handlePostUsers))).Methods(http.MethodPost)
-	h.Handle("/users",
-		mw.administrator(http.HandlerFunc(h.handleGetUsers))).Methods(http.MethodGet)
-	h.Handle("/users/{id}",
-		mw.administrator(http.HandlerFunc(h.handleGetUser))).Methods(http.MethodGet)
-	h.Handle("/users/{id}",
-		mw.authenticated(http.HandlerFunc(h.handlePutUser))).Methods(http.MethodPut)
-	h.Handle("/users/{id}",
-		mw.administrator(http.HandlerFunc(h.handleDeleteUser))).Methods(http.MethodDelete)
-	h.Handle("/users/{id}/passwd",
-		mw.authenticated(http.HandlerFunc(h.handlePostUserPasswd)))
-	h.Handle("/users/{userId}/resources/{resourceType}",
-		mw.authenticated(http.HandlerFunc(h.handlePostUserResource))).Methods(http.MethodPost)
-	h.Handle("/users/{userId}/resources/{resourceType}/{resourceId}",
-		mw.authenticated(http.HandlerFunc(h.handleDeleteUserResource))).Methods(http.MethodDelete)
-	h.Handle("/users/admin/check",
-		mw.public(http.HandlerFunc(h.handleGetAdminCheck)))
-	h.Handle("/users/admin/init",
-		mw.public(http.HandlerFunc(h.handlePostAdminInit)))
-
-	return h
-}
-
-// handlePostUsers handles POST requests on /users
-func (handler *UserHandler) handlePostUsers(w http.ResponseWriter, r *http.Request) {
-	var req postUsersRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		Error(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	_, err := govalidator.ValidateStruct(req)
-	if err != nil {
-		Error(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	var role portainer.UserRole
-	if req.Role == 1 {
-		role = portainer.AdministratorRole
-	} else {
-		role = portainer.StandardUserRole
-	}
-
-	user, err := handler.UserService.UserByUsername(req.Username)
-	if err != nil && err != portainer.ErrUserNotFound {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-	if user != nil {
-		Error(w, portainer.ErrUserAlreadyExists, http.StatusConflict, handler.Logger)
-		return
-	}
-
-	user = &portainer.User{
-		Username: req.Username,
-		Role:     role,
-	}
-	user.Password, err = handler.CryptoService.Hash(req.Password)
-	if err != nil {
-		Error(w, portainer.ErrCryptoHashFailure, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	err = handler.UserService.CreateUser(user)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-}
-
-type postUsersRequest struct {
-	Username string `valid:"alphanum,required"`
-	Password string `valid:"required"`
-	Role     int    `valid:"required"`
-}
-
-// handleGetUsers handles GET requests on /users
-func (handler *UserHandler) handleGetUsers(w http.ResponseWriter, r *http.Request) {
-	users, err := handler.UserService.Users()
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-
-	for i := range users {
-		users[i].Password = ""
-	}
-	encodeJSON(w, users, handler.Logger)
-}
-
-// handlePostUserPasswd handles POST requests on /users/:id/passwd
-func (handler *UserHandler) handlePostUserPasswd(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		handleNotAllowed(w, []string{http.MethodPost})
-		return
-	}
-
-	vars := mux.Vars(r)
-	id := vars["id"]
-
-	userID, err := strconv.Atoi(id)
-	if err != nil {
-		Error(w, err, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	var req postUserPasswdRequest
-	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
-		Error(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	_, err = govalidator.ValidateStruct(req)
-	if err != nil {
-		Error(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	var password = req.Password
-
-	u, err := handler.UserService.User(portainer.UserID(userID))
-	if err == portainer.ErrUserNotFound {
-		Error(w, err, http.StatusNotFound, handler.Logger)
-		return
-	} else if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-
-	valid := true
-	err = handler.CryptoService.CompareHashAndData(u.Password, password)
-	if err != nil {
-		valid = false
-	}
-
-	encodeJSON(w, &postUserPasswdResponse{Valid: valid}, handler.Logger)
-}
-
-type postUserPasswdRequest struct {
-	Password string `valid:"required"`
-}
-
-type postUserPasswdResponse struct {
-	Valid bool `json:"valid"`
-}
-
-// handleGetUser handles GET requests on /users/:id
-func (handler *UserHandler) handleGetUser(w http.ResponseWriter, r *http.Request) {
-	vars := mux.Vars(r)
-	id := vars["id"]
-
-	userID, err := strconv.Atoi(id)
-	if err != nil {
-		Error(w, err, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	user, err := handler.UserService.User(portainer.UserID(userID))
-	if err == portainer.ErrUserNotFound {
-		Error(w, err, http.StatusNotFound, handler.Logger)
-		return
-	} else if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-
-	user.Password = ""
-	encodeJSON(w, &user, handler.Logger)
-}
-
-// handlePutUser handles PUT requests on /users/:id
-func (handler *UserHandler) handlePutUser(w http.ResponseWriter, r *http.Request) {
-	vars := mux.Vars(r)
-	id := vars["id"]
-
-	userID, err := strconv.Atoi(id)
-	if err != nil {
-		Error(w, err, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	tokenData, err := extractTokenDataFromRequestContext(r)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-	}
-
-	if tokenData.Role != portainer.AdministratorRole && tokenData.ID != portainer.UserID(userID) {
-		Error(w, portainer.ErrUnauthorized, http.StatusForbidden, handler.Logger)
-		return
-	}
-
-	var req putUserRequest
-	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
-		Error(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	_, err = govalidator.ValidateStruct(req)
-	if err != nil {
-		Error(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	if req.Password == "" && req.Role == 0 {
-		Error(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	user, err := handler.UserService.User(portainer.UserID(userID))
-	if err == portainer.ErrUserNotFound {
-		Error(w, err, http.StatusNotFound, handler.Logger)
-		return
-	} else if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-
-	if req.Password != "" {
-		user.Password, err = handler.CryptoService.Hash(req.Password)
-		if err != nil {
-			Error(w, portainer.ErrCryptoHashFailure, http.StatusBadRequest, handler.Logger)
-			return
-		}
-	}
-
-	if req.Role != 0 {
-		if tokenData.Role != portainer.AdministratorRole {
-			Error(w, portainer.ErrUnauthorized, http.StatusForbidden, handler.Logger)
-			return
-		}
-		if req.Role == 1 {
-			user.Role = portainer.AdministratorRole
-		} else {
-			user.Role = portainer.StandardUserRole
-		}
-	}
-
-	err = handler.UserService.UpdateUser(user.ID, user)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-}
-
-type putUserRequest struct {
-	Password string `valid:"-"`
-	Role     int    `valid:"-"`
-}
-
-// handlePostAdminInit handles GET requests on /users/admin/check
-func (handler *UserHandler) handleGetAdminCheck(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		handleNotAllowed(w, []string{http.MethodGet})
-		return
-	}
-
-	users, err := handler.UserService.UsersByRole(portainer.AdministratorRole)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-	if len(users) == 0 {
-		Error(w, portainer.ErrUserNotFound, http.StatusNotFound, handler.Logger)
-		return
-	}
-}
-
-// handlePostAdminInit handles POST requests on /users/admin/init
-func (handler *UserHandler) handlePostAdminInit(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		handleNotAllowed(w, []string{http.MethodPost})
-		return
-	}
-
-	var req postAdminInitRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		Error(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	_, err := govalidator.ValidateStruct(req)
-	if err != nil {
-		Error(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	user, err := handler.UserService.UserByUsername("admin")
-	if err == portainer.ErrUserNotFound {
-		user := &portainer.User{
-			Username: "admin",
-			Role:     portainer.AdministratorRole,
-		}
-		user.Password, err = handler.CryptoService.Hash(req.Password)
-		if err != nil {
-			Error(w, portainer.ErrCryptoHashFailure, http.StatusBadRequest, handler.Logger)
-			return
-		}
-
-		err = handler.UserService.CreateUser(user)
-		if err != nil {
-			Error(w, err, http.StatusInternalServerError, handler.Logger)
-			return
-		}
-	} else if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-	if user != nil {
-		Error(w, portainer.ErrAdminAlreadyInitialized, http.StatusForbidden, handler.Logger)
-		return
-	}
-}
-
-type postAdminInitRequest struct {
-	Password string `valid:"required"`
-}
-
-// handleDeleteUser handles DELETE requests on /users/:id
-func (handler *UserHandler) handleDeleteUser(w http.ResponseWriter, r *http.Request) {
-	vars := mux.Vars(r)
-	id := vars["id"]
-
-	userID, err := strconv.Atoi(id)
-	if err != nil {
-		Error(w, err, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	_, err = handler.UserService.User(portainer.UserID(userID))
-
-	if err == portainer.ErrUserNotFound {
-		Error(w, err, http.StatusNotFound, handler.Logger)
-		return
-	} else if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-
-	err = handler.UserService.DeleteUser(portainer.UserID(userID))
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-}
-
-// handlePostUserResource handles POST requests on /users/:userId/resources/:resourceType
-func (handler *UserHandler) handlePostUserResource(w http.ResponseWriter, r *http.Request) {
-	vars := mux.Vars(r)
-	userID := vars["userId"]
-	resourceType := vars["resourceType"]
-
-	uid, err := strconv.Atoi(userID)
-	if err != nil {
-		Error(w, err, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	var rcType portainer.ResourceControlType
-	if resourceType == "container" {
-		rcType = portainer.ContainerResourceControl
-	} else if resourceType == "service" {
-		rcType = portainer.ServiceResourceControl
-	} else if resourceType == "volume" {
-		rcType = portainer.VolumeResourceControl
-	} else {
-		Error(w, ErrInvalidQueryFormat, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	tokenData, err := extractTokenDataFromRequestContext(r)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-	}
-	if tokenData.ID != portainer.UserID(uid) {
-		Error(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
-		return
-	}
-
-	var req postUserResourceRequest
-	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
-		Error(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	_, err = govalidator.ValidateStruct(req)
-	if err != nil {
-		Error(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	resource := portainer.ResourceControl{
-		OwnerID:     portainer.UserID(uid),
-		ResourceID:  req.ResourceID,
-		AccessLevel: portainer.RestrictedResourceAccessLevel,
-	}
-
-	err = handler.ResourceControlService.CreateResourceControl(req.ResourceID, &resource, rcType)
-	if err != nil {
-		Error(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
-		return
-	}
-}
-
-type postUserResourceRequest struct {
-	ResourceID string `valid:"required"`
-}
-
-// handleDeleteUserResource handles DELETE requests on /users/:userId/resources/:resourceType/:resourceId
-func (handler *UserHandler) handleDeleteUserResource(w http.ResponseWriter, r *http.Request) {
-	vars := mux.Vars(r)
-	userID := vars["userId"]
-	resourceID := vars["resourceId"]
-	resourceType := vars["resourceType"]
-
-	uid, err := strconv.Atoi(userID)
-	if err != nil {
-		Error(w, err, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	var rcType portainer.ResourceControlType
-	if resourceType == "container" {
-		rcType = portainer.ContainerResourceControl
-	} else if resourceType == "service" {
-		rcType = portainer.ServiceResourceControl
-	} else if resourceType == "volume" {
-		rcType = portainer.VolumeResourceControl
-	} else {
-		Error(w, ErrInvalidQueryFormat, http.StatusBadRequest, handler.Logger)
-		return
-	}
-
-	tokenData, err := extractTokenDataFromRequestContext(r)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-	}
-	if tokenData.Role != portainer.AdministratorRole && tokenData.ID != portainer.UserID(uid) {
-		Error(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
-		return
-	}
-
-	err = handler.ResourceControlService.DeleteResourceControl(resourceID, rcType)
-	if err != nil {
-		Error(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-}
@@ -0,0 +1,123 @@
+package ldap
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/crypto"
+
+	"gopkg.in/ldap.v2"
+)
+
+const (
+	// ErrUserNotFound defines an error raised when the user is not found via LDAP search
+	// or that too many entries (> 1) are returned.
+	ErrUserNotFound = portainer.Error("User not found or too many entries returned")
+)
+
+// Service represents a service used to authenticate users against a LDAP/AD.
+type Service struct{}
+
+func searchUser(username string, conn *ldap.Conn, settings []portainer.LDAPSearchSettings) (string, error) {
+	var userDN string
+	found := false
+	for _, searchSettings := range settings {
+		searchRequest := ldap.NewSearchRequest(
+			searchSettings.BaseDN,
+			ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
+			fmt.Sprintf("(&%s(%s=%s))", searchSettings.Filter, searchSettings.UserNameAttribute, username),
+			[]string{"dn"},
+			nil,
+		)
+
+		// Deliberately skip errors on the search request so that we can jump to other search settings
+		// if any issue arise with the current one.
+		sr, _ := conn.Search(searchRequest)
+
+		if len(sr.Entries) == 1 {
+			found = true
+			userDN = sr.Entries[0].DN
+			break
+		}
+	}
+
+	if !found {
+		return "", ErrUserNotFound
+	}
+
+	return userDN, nil
+}
+
+func createConnection(settings *portainer.LDAPSettings) (*ldap.Conn, error) {
+
+	if settings.TLSConfig.TLS || settings.StartTLS {
+		config, err := crypto.CreateTLSConfiguration(&settings.TLSConfig)
+		if err != nil {
+			return nil, err
+		}
+		config.ServerName = strings.Split(settings.URL, ":")[0]
+
+		if settings.TLSConfig.TLS {
+			return ldap.DialTLS("tcp", settings.URL, config)
+		}
+
+		conn, err := ldap.Dial("tcp", settings.URL)
+		if err != nil {
+			return nil, err
+		}
+
+		err = conn.StartTLS(config)
+		if err != nil {
+			return nil, err
+		}
+
+		return conn, nil
+	}
+
+	return ldap.Dial("tcp", settings.URL)
+}
+
+// AuthenticateUser is used to authenticate a user against a LDAP/AD.
+func (*Service) AuthenticateUser(username, password string, settings *portainer.LDAPSettings) error {
+
+	connection, err := createConnection(settings)
+	if err != nil {
+		return err
+	}
+	defer connection.Close()
+
+	err = connection.Bind(settings.ReaderDN, settings.Password)
+	if err != nil {
+		return err
+	}
+
+	userDN, err := searchUser(username, connection, settings.SearchSettings)
+	if err != nil {
+		return err
+	}
+
+	err = connection.Bind(userDN, password)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// TestConnectivity is used to test a connection against the LDAP server using the credentials
+// specified in the LDAPSettings.
+func (*Service) TestConnectivity(settings *portainer.LDAPSettings) error {
+
+	connection, err := createConnection(settings)
+	if err != nil {
+		return err
+	}
+	defer connection.Close()
+
+	err = connection.Bind(settings.ReaderDN, settings.Password)
+	if err != nil {
+		return err
+	}
+	return nil
+}
@@ -1,8 +1,6 @@
 package portainer

-import (
-	"io"
-)
+import "io"

 type (
 	// Pair defines a key/value string pair
@@ -19,27 +17,67 @@ type (
 		ExternalEndpoints *string
 		SyncInterval      *string
 		Endpoint          *string
-		Labels            *[]Pair
-		Logo              *string
-		Templates         *string
 		NoAuth            *bool
 		NoAnalytics       *bool
 		TLSVerify         *bool
 		TLSCacert         *string
 		TLSCert           *string
 		TLSKey            *string
+		SSL               *bool
+		SSLCert           *string
+		SSLKey            *string
+		AdminPassword     *string
+		// Deprecated fields
+		Logo      *string
+		Templates *string
+		Labels    *[]Pair
 	}

-	// Settings represents Portainer settings.
+	// Status represents the application status.
+	Status struct {
+		Authentication     bool   `json:"Authentication"`
+		EndpointManagement bool   `json:"EndpointManagement"`
+		Analytics          bool   `json:"Analytics"`
+		Version            string `json:"Version"`
+	}
+
+	// LDAPSettings represents the settings used to connect to a LDAP server.
+	LDAPSettings struct {
+		ReaderDN       string               `json:"ReaderDN"`
+		Password       string               `json:"Password"`
+		URL            string               `json:"URL"`
+		TLSConfig      TLSConfiguration     `json:"TLSConfig"`
+		StartTLS       bool                 `json:"StartTLS"`
+		SearchSettings []LDAPSearchSettings `json:"SearchSettings"`
+	}
+
+	// TLSConfiguration represents a TLS configuration.
+	TLSConfiguration struct {
+		TLS           bool   `json:"TLS"`
+		TLSSkipVerify bool   `json:"TLSSkipVerify"`
+		TLSCACertPath string `json:"TLSCACert,omitempty"`
+		TLSCertPath   string `json:"TLSCert,omitempty"`
+		TLSKeyPath    string `json:"TLSKey,omitempty"`
+	}
+
+	// LDAPSearchSettings represents settings used to search for users in a LDAP server.
+	LDAPSearchSettings struct {
+		BaseDN            string `json:"BaseDN"`
+		Filter            string `json:"Filter"`
+		UserNameAttribute string `json:"UserNameAttribute"`
+	}
+
+	// Settings represents the application settings.
 	Settings struct {
-		HiddenLabels       []Pair `json:"hiddenLabels"`
-		Logo               string `json:"logo"`
-		Authentication     bool   `json:"authentication"`
-		Analytics          bool   `json:"analytics"`
-		EndpointManagement bool   `json:"endpointManagement"`
+		TemplatesURL                string               `json:"TemplatesURL"`
+		LogoURL                     string               `json:"LogoURL"`
+		BlackListedLabels           []Pair               `json:"BlackListedLabels"`
+		DisplayExternalContributors bool                 `json:"DisplayExternalContributors"`
+		AuthenticationMethod        AuthenticationMethod `json:"AuthenticationMethod"`
+		LDAPSettings                LDAPSettings         `json:"LDAPSettings"`
 	}

-	// User represent a user account.
+	// User represents a user account.
 	User struct {
 		ID       UserID   `json:"Id"`
 		Username string   `json:"Username"`
@@ -51,9 +89,35 @@ type (
 	UserID int

 	// UserRole represents the role of a user. It can be either an administrator
-	// or a regular user.
+	// or a regular user
 	UserRole int

+	// AuthenticationMethod represents the authentication method used to authenticate a user.
+	AuthenticationMethod int
+
+	// Team represents a list of user accounts.
+	Team struct {
+		ID   TeamID `json:"Id"`
+		Name string `json:"Name"`
+	}
+
+	// TeamID represents a team identifier
+	TeamID int
+
+	// TeamMembership represents a membership association between a user and a team
+	TeamMembership struct {
+		ID     TeamMembershipID `json:"Id"`
+		UserID UserID           `json:"UserID"`
+		TeamID TeamID           `json:"TeamID"`
+		Role   MembershipRole   `json:"Role"`
+	}
+
+	// TeamMembershipID represents a team membership identifier
+	TeamMembershipID int
+
+	// MembershipRole represents the role of a user within a team
+	MembershipRole int
+
 	// TokenData represents the data embedded in a JWT token.
 	TokenData struct {
 		ID       UserID
@@ -61,35 +125,87 @@ type (
 		Role     UserRole
 	}

+	// RegistryID represents a registry identifier.
+	RegistryID int
+
+	// Registry represents a Docker registry with all the info required
+	// to connect to it.
+	Registry struct {
+		ID              RegistryID `json:"Id"`
+		Name            string     `json:"Name"`
+		URL             string     `json:"URL"`
+		Authentication  bool       `json:"Authentication"`
+		Username        string     `json:"Username"`
+		Password        string     `json:"Password"`
+		AuthorizedUsers []UserID   `json:"AuthorizedUsers"`
+		AuthorizedTeams []TeamID   `json:"AuthorizedTeams"`
+	}
+
+	// DockerHub represents all the required information to connect and use the
+	// Docker Hub.
+	DockerHub struct {
+		Authentication bool   `json:"Authentication"`
+		Username       string `json:"Username"`
+		Password       string `json:"Password"`
+	}
+
 	// EndpointID represents an endpoint identifier.
 	EndpointID int

 	// Endpoint represents a Docker endpoint with all the info required
 	// to connect to it.
 	Endpoint struct {
-		ID              EndpointID `json:"Id"`
-		Name            string     `json:"Name"`
-		URL             string     `json:"URL"`
-		TLS             bool       `json:"TLS"`
-		TLSCACertPath   string     `json:"TLSCACert,omitempty"`
-		TLSCertPath     string     `json:"TLSCert,omitempty"`
-		TLSKeyPath      string     `json:"TLSKey,omitempty"`
-		AuthorizedUsers []UserID   `json:"AuthorizedUsers"`
+		ID              EndpointID       `json:"Id"`
+		Name            string           `json:"Name"`
+		URL             string           `json:"URL"`
+		PublicURL       string           `json:"PublicURL"`
+		TLSConfig       TLSConfiguration `json:"TLSConfig"`
+		AuthorizedUsers []UserID         `json:"AuthorizedUsers"`
+		AuthorizedTeams []TeamID         `json:"AuthorizedTeams"`
+
+		// Deprecated fields
+		// Deprecated in DBVersion == 4
+		TLS           bool   `json:"TLS,omitempty"`
+		TLSCACertPath string `json:"TLSCACert,omitempty"`
+		TLSCertPath   string `json:"TLSCert,omitempty"`
+		TLSKeyPath    string `json:"TLSKey,omitempty"`
 	}

-	// ResourceControl represent a reference to a Docker resource with specific controls
+	// ResourceControlID represents a resource control identifier.
+	ResourceControlID int
+
+	// ResourceControl represent a reference to a Docker resource with specific access controls
 	ResourceControl struct {
-		OwnerID     UserID              `json:"OwnerId"`
-		ResourceID  string              `json:"ResourceId"`
+		ID                 ResourceControlID    `json:"Id"`
+		ResourceID         string               `json:"ResourceId"`
+		SubResourceIDs     []string             `json:"SubResourceIds"`
+		Type               ResourceControlType  `json:"Type"`
+		AdministratorsOnly bool                 `json:"AdministratorsOnly"`
+		UserAccesses       []UserResourceAccess `json:"UserAccesses"`
+		TeamAccesses       []TeamResourceAccess `json:"TeamAccesses"`
+
+		// Deprecated fields
+		// Deprecated in DBVersion == 2
+		OwnerID     UserID              `json:"OwnerId,omitempty"`
+		AccessLevel ResourceAccessLevel `json:"AccessLevel,omitempty"`
+	}
+
+	// ResourceControlType represents the type of resource associated to the resource control (volume, container, service).
+	ResourceControlType int
+
+	// UserResourceAccess represents the level of control on a resource for a specific user.
+	UserResourceAccess struct {
+		UserID      UserID              `json:"UserId"`
 		AccessLevel ResourceAccessLevel `json:"AccessLevel"`
 	}

-	// ResourceControlType represents a type of resource control.
-	// Can be one of: container, service or volume.
-	ResourceControlType int
+	// TeamResourceAccess represents the level of control on a resource for a specific team.
+	TeamResourceAccess struct {
+		TeamID      TeamID              `json:"TeamId"`
+		AccessLevel ResourceAccessLevel `json:"AccessLevel"`
+	}

-	// ResourceAccessLevel represents the level of control associated to a resource for a specific owner.
-	// Can be one of: full, restricted, limited.
+	// ResourceAccessLevel represents the level of control associated to a resource.
 	ResourceAccessLevel int

 	// TLSFileType represents a type of TLS file required to connect to a Docker endpoint.
@@ -125,6 +241,29 @@ type (
 		DeleteUser(ID UserID) error
 	}

+	// TeamService represents a service for managing user data.
+	TeamService interface {
+		Team(ID TeamID) (*Team, error)
+		TeamByName(name string) (*Team, error)
+		Teams() ([]Team, error)
+		CreateTeam(team *Team) error
+		UpdateTeam(ID TeamID, team *Team) error
+		DeleteTeam(ID TeamID) error
+	}
+
+	// TeamMembershipService represents a service for managing team membership data.
+	TeamMembershipService interface {
+		TeamMembership(ID TeamMembershipID) (*TeamMembership, error)
+		TeamMemberships() ([]TeamMembership, error)
+		TeamMembershipsByUserID(userID UserID) ([]TeamMembership, error)
+		TeamMembershipsByTeamID(teamID TeamID) ([]TeamMembership, error)
+		CreateTeamMembership(membership *TeamMembership) error
+		UpdateTeamMembership(ID TeamMembershipID, membership *TeamMembership) error
+		DeleteTeamMembership(ID TeamMembershipID) error
+		DeleteTeamMembershipByUserID(userID UserID) error
+		DeleteTeamMembershipByTeamID(teamID TeamID) error
+	}
+
 	// EndpointService represents a service for managing endpoint data.
 	EndpointService interface {
 		Endpoint(ID EndpointID) (*Endpoint, error)
@@ -135,6 +274,27 @@ type (
 		Synchronize(toCreate, toUpdate, toDelete []*Endpoint) error
 	}

+	// RegistryService represents a service for managing registry data.
+	RegistryService interface {
+		Registry(ID RegistryID) (*Registry, error)
+		Registries() ([]Registry, error)
+		CreateRegistry(registry *Registry) error
+		UpdateRegistry(ID RegistryID, registry *Registry) error
+		DeleteRegistry(ID RegistryID) error
+	}
+
+	// DockerHubService represents a service for managing the DockerHub object.
+	DockerHubService interface {
+		DockerHub() (*DockerHub, error)
+		StoreDockerHub(registry *DockerHub) error
+	}
+
+	// SettingsService represents a service for managing application settings.
+	SettingsService interface {
+		Settings() (*Settings, error)
+		StoreSettings(settings *Settings) error
+	}
+
 	// VersionService represents a service for managing version data.
 	VersionService interface {
 		DBVersion() (int, error)
@@ -143,10 +303,12 @@ type (

 	// ResourceControlService represents a service for managing resource control data.
 	ResourceControlService interface {
-		ResourceControl(resourceID string, rcType ResourceControlType) (*ResourceControl, error)
-		ResourceControls(rcType ResourceControlType) ([]ResourceControl, error)
-		CreateResourceControl(resourceID string, rc *ResourceControl, rcType ResourceControlType) error
-		DeleteResourceControl(resourceID string, rcType ResourceControlType) error
+		ResourceControl(ID ResourceControlID) (*ResourceControl, error)
+		ResourceControlByResourceID(resourceID string) (*ResourceControl, error)
+		ResourceControls() ([]ResourceControl, error)
+		CreateResourceControl(rc *ResourceControl) error
+		UpdateResourceControl(ID ResourceControlID, resourceControl *ResourceControl) error
+		DeleteResourceControl(ID ResourceControlID) error
 	}

 	// CryptoService represents a service for encrypting/hashing data.
@@ -163,22 +325,31 @@ type (

 	// FileService represents a service for managing files.
 	FileService interface {
-		StoreTLSFile(endpointID EndpointID, fileType TLSFileType, r io.Reader) error
-		GetPathForTLSFile(endpointID EndpointID, fileType TLSFileType) (string, error)
-		DeleteTLSFiles(endpointID EndpointID) error
+		StoreTLSFile(folder string, fileType TLSFileType, r io.Reader) error
+		GetPathForTLSFile(folder string, fileType TLSFileType) (string, error)
+		DeleteTLSFile(folder string, fileType TLSFileType) error
+		DeleteTLSFiles(folder string) error
 	}

 	// EndpointWatcher represents a service to synchronize the endpoints via an external source.
 	EndpointWatcher interface {
 		WatchEndpointFile(endpointFilePath string) error
 	}
+
+	// LDAPService represents a service used to authenticate users against a LDAP/AD.
+	LDAPService interface {
+		AuthenticateUser(username, password string, settings *LDAPSettings) error
+		TestConnectivity(settings *LDAPSettings) error
+	}
 )

 const (
-	// APIVersion is the version number of Portainer API.
-	APIVersion = "1.12.3"
-	// DBVersion is the version number of Portainer database.
-	DBVersion = 1
+	// APIVersion is the version number of the Portainer API.
+	APIVersion = "1.14.2"
+	// DBVersion is the version number of the Portainer database.
+	DBVersion = 4
+	// DefaultTemplatesURL represents the default URL for the templates definitions.
+	DefaultTemplatesURL = "https://raw.githubusercontent.com/portainer/templates/master/templates.json"
 )

 const (
@@ -190,6 +361,14 @@ const (
 	TLSFileKey
 )

+const (
+	_ MembershipRole = iota
+	// TeamLeader represents a leader role inside a team
+	TeamLeader
+	// TeamMember represents a member role inside a team
+	TeamMember
+)
+
 const (
 	_ UserRole = iota
 	// AdministratorRole represents an administrator user role
@@ -199,17 +378,29 @@ const (
 )

 const (
-	_ ResourceControlType = iota
-	// ContainerResourceControl represents a resource control for a container
-	ContainerResourceControl
-	// ServiceResourceControl represents a resource control for a service
-	ServiceResourceControl
-	// VolumeResourceControl represents a resource control for a volume
-	VolumeResourceControl
+	_ AuthenticationMethod = iota
+	// AuthenticationInternal represents the internal authentication method (authentication against Portainer API)
+	AuthenticationInternal
+	// AuthenticationLDAP represents the LDAP authentication method (authentication against a LDAP server)
+	AuthenticationLDAP
 )

 const (
 	_ ResourceAccessLevel = iota
-	// RestrictedResourceAccessLevel represents a restricted access level on a resource (private ownership)
-	RestrictedResourceAccessLevel
+	// ReadWriteAccessLevel represents an access level with read-write permissions on a resource
+	ReadWriteAccessLevel
+)
+
+const (
+	_ ResourceControlType = iota
+	// ContainerResourceControl represents a resource control associated to a Docker container
+	ContainerResourceControl
+	// ServiceResourceControl represents a resource control associated to a Docker service
+	ServiceResourceControl
+	// VolumeResourceControl represents a resource control associated to a Docker volume
+	VolumeResourceControl
+	// NetworkResourceControl represents a resource control associated to a Docker network
+	NetworkResourceControl
+	// SecretResourceControl represents a resource control associated to a Docker secret
+	SecretResourceControl
 )
@@ -5,7 +5,7 @@ angular.module('portainer.helpers', []);
 angular.module('portainer', [
  'ui.bootstrap',
  'ui.router',
-  'ui.select',
+  'isteven-multi-select',
  'ngCookies',
  'ngSanitize',
  'ngFileUpload',
@@ -23,39 +23,59 @@ angular.module('portainer', [
  'container',
  'containerConsole',
  'containerLogs',
+  'containerStats',
+  'serviceLogs',
  'containers',
  'createContainer',
  'createNetwork',
+  'createRegistry',
+  'createSecret',
  'createService',
  'createVolume',
-  'docker',
+  'engine',
  'endpoint',
  'endpointAccess',
-  'endpointInit',
  'endpoints',
  'events',
  'image',
  'images',
+  'initAdmin',
+  'initEndpoint',
  'main',
  'network',
  'networks',
  'node',
+  'registries',
+  'registry',
+  'registryAccess',
+  'secrets',
+  'secret',
  'service',
  'services',
  'settings',
+  'settingsAuthentication',
  'sidebar',
-  'stats',
  'swarm',
+  'swarmVisualizer',
  'task',
+  'team',
+  'teams',
  'templates',
  'user',
  'users',
-  'volumes'])
-  .config(['$stateProvider', '$urlRouterProvider', '$httpProvider', 'localStorageServiceProvider', 'jwtOptionsProvider', 'AnalyticsProvider', '$uibTooltipProvider', function ($stateProvider, $urlRouterProvider, $httpProvider, localStorageServiceProvider, jwtOptionsProvider, AnalyticsProvider, $uibTooltipProvider) {
+  'userSettings',
+  'volume',
+  'volumes',
+  'rzModule'])
+  .config(['$stateProvider', '$urlRouterProvider', '$httpProvider', 'localStorageServiceProvider', 'jwtOptionsProvider', 'AnalyticsProvider', '$uibTooltipProvider', '$compileProvider', function ($stateProvider, $urlRouterProvider, $httpProvider, localStorageServiceProvider, jwtOptionsProvider, AnalyticsProvider, $uibTooltipProvider, $compileProvider) {
    'use strict';

+    var environment = '@@ENVIRONMENT';
+    if (environment === 'production') {
+      $compileProvider.debugInfoEnabled(false);
+    }
+
    localStorageServiceProvider
-    .setStorageType('sessionStorage')
    .setPrefix('portainer');

    jwtOptionsProvider.config({
@@ -73,6 +93,8 @@ angular.module('portainer', [

    $urlRouterProvider.otherwise('/auth');

+    toastr.options.timeOut = 3000;
+
    $uibTooltipProvider.setTriggers({
      'mouseenter': 'mouseleave',
      'click': 'click',
@@ -98,7 +120,7 @@ angular.module('portainer', [
        error: ''
      },
      views: {
-        "content@": {
+        'content@': {
          templateUrl: 'app/components/auth/auth.html',
          controller: 'AuthenticationController'
        }
@@ -111,63 +133,76 @@ angular.module('portainer', [
      parent: 'root',
      url: '/containers/',
      views: {
-        "content@": {
+        'content@': {
          templateUrl: 'app/components/containers/containers.html',
          controller: 'ContainersController'
        },
-        "sidebar@": {
+        'sidebar@': {
          templateUrl: 'app/components/sidebar/sidebar.html',
          controller: 'SidebarController'
        }
      }
    })
    .state('container', {
-      url: "^/containers/:id",
+      url: '^/containers/:id',
      views: {
-        "content@": {
+        'content@': {
          templateUrl: 'app/components/container/container.html',
          controller: 'ContainerController'
        },
-        "sidebar@": {
+        'sidebar@': {
          templateUrl: 'app/components/sidebar/sidebar.html',
          controller: 'SidebarController'
        }
      }
    })
    .state('stats', {
-      url: "^/containers/:id/stats",
+      url: '^/containers/:id/stats',
      views: {
-        "content@": {
-          templateUrl: 'app/components/stats/stats.html',
-          controller: 'StatsController'
+        'content@': {
+          templateUrl: 'app/components/containerStats/containerStats.html',
+          controller: 'ContainerStatsController'
        },
-        "sidebar@": {
+        'sidebar@': {
          templateUrl: 'app/components/sidebar/sidebar.html',
          controller: 'SidebarController'
        }
      }
    })
-    .state('logs', {
-      url: "^/containers/:id/logs",
+    .state('containerlogs', {
+      url: '^/containers/:id/logs',
      views: {
-        "content@": {
+        'content@': {
          templateUrl: 'app/components/containerLogs/containerlogs.html',
          controller: 'ContainerLogsController'
        },
-        "sidebar@": {
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('servicelogs', {
+      url: '^/services/:id/logs',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/serviceLogs/servicelogs.html',
+          controller: 'ServiceLogsController'
+        },
+        'sidebar@': {
          templateUrl: 'app/components/sidebar/sidebar.html',
          controller: 'SidebarController'
        }
      }
    })
    .state('console', {
-      url: "^/containers/:id/console",
+      url: '^/containers/:id/console',
      views: {
-        "content@": {
+        'content@': {
          templateUrl: 'app/components/containerConsole/containerConsole.html',
          controller: 'ContainerConsoleController'
        },
-        "sidebar@": {
+        'sidebar@': {
          templateUrl: 'app/components/sidebar/sidebar.html',
          controller: 'SidebarController'
        }
@@ -177,11 +212,11 @@ angular.module('portainer', [
      parent: 'root',
      url: '/dashboard',
      views: {
-        "content@": {
+        'content@': {
          templateUrl: 'app/components/dashboard/dashboard.html',
          controller: 'DashboardController'
        },
-        "sidebar@": {
+        'sidebar@': {
          templateUrl: 'app/components/sidebar/sidebar.html',
          controller: 'SidebarController'
        }
@@ -189,88 +224,141 @@ angular.module('portainer', [
    })
    .state('actions', {
      abstract: true,
-      url: "/actions",
+      url: '/actions',
      views: {
-        "content@": {
+        'content@': {
          template: '<div ui-view="content@"></div>'
        },
-        "sidebar@": {
+        'sidebar@': {
          template: '<div ui-view="sidebar@"></div>'
        }
      }
    })
    .state('actions.create', {
      abstract: true,
-      url: "/create",
+      url: '/create',
      views: {
-        "content@": {
+        'content@': {
          template: '<div ui-view="content@"></div>'
        },
-        "sidebar@": {
+        'sidebar@': {
          template: '<div ui-view="sidebar@"></div>'
        }
      }
    })
    .state('actions.create.container', {
-      url: "/container",
+      url: '/container/:from',
      views: {
-        "content@": {
+        'content@': {
          templateUrl: 'app/components/createContainer/createcontainer.html',
          controller: 'CreateContainerController'
        },
-        "sidebar@": {
+        'sidebar@': {
          templateUrl: 'app/components/sidebar/sidebar.html',
          controller: 'SidebarController'
        }
      }
    })
    .state('actions.create.network', {
-      url: "/network",
+      url: '/network',
      views: {
-        "content@": {
+        'content@': {
          templateUrl: 'app/components/createNetwork/createnetwork.html',
          controller: 'CreateNetworkController'
        },
-        "sidebar@": {
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('actions.create.registry', {
+      url: '/registry',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/createRegistry/createregistry.html',
+          controller: 'CreateRegistryController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('actions.create.secret', {
+      url: '/secret',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/createSecret/createsecret.html',
+          controller: 'CreateSecretController'
+        },
+        'sidebar@': {
          templateUrl: 'app/components/sidebar/sidebar.html',
          controller: 'SidebarController'
        }
      }
    })
    .state('actions.create.service', {
-      url: "/service",
+      url: '/service',
      views: {
-        "content@": {
+        'content@': {
          templateUrl: 'app/components/createService/createservice.html',
          controller: 'CreateServiceController'
        },
-        "sidebar@": {
+        'sidebar@': {
          templateUrl: 'app/components/sidebar/sidebar.html',
          controller: 'SidebarController'
        }
      }
    })
    .state('actions.create.volume', {
-      url: "/volume",
+      url: '/volume',
      views: {
-        "content@": {
+        'content@': {
          templateUrl: 'app/components/createVolume/createvolume.html',
          controller: 'CreateVolumeController'
        },
-        "sidebar@": {
+        'sidebar@': {
          templateUrl: 'app/components/sidebar/sidebar.html',
          controller: 'SidebarController'
        }
      }
    })
-    .state('docker', {
-      url: '/docker/',
+    .state('init', {
+      abstract: true,
+      url: '/init',
      views: {
-        "content@": {
-          templateUrl: 'app/components/docker/docker.html',
-          controller: 'DockerController'
+        'content@': {
+          template: '<div ui-view="content@"></div>'
+        }
+      }
+    })
+    .state('init.endpoint', {
+      url: '/endpoint',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/initEndpoint/initEndpoint.html',
+          controller: 'InitEndpointController'
+        }
+      }
+    })
+    .state('init.admin', {
+      url: '/admin',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/initAdmin/initAdmin.html',
+          controller: 'InitAdminController'
+        }
+      }
+    })
+    .state('engine', {
+      url: '/engine/',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/engine/engine.html',
+          controller: 'EngineController'
        },
-        "sidebar@": {
+        'sidebar@': {
          templateUrl: 'app/components/sidebar/sidebar.html',
          controller: 'SidebarController'
        }
@@ -279,11 +367,11 @@ angular.module('portainer', [
    .state('endpoints', {
      url: '/endpoints/',
      views: {
-        "content@": {
+        'content@': {
          templateUrl: 'app/components/endpoints/endpoints.html',
          controller: 'EndpointsController'
        },
-        "sidebar@": {
+        'sidebar@': {
          templateUrl: 'app/components/sidebar/sidebar.html',
          controller: 'SidebarController'
        }
@@ -292,11 +380,11 @@ angular.module('portainer', [
    .state('endpoint', {
      url: '^/endpoints/:id',
      views: {
-        "content@": {
+        'content@': {
          templateUrl: 'app/components/endpoint/endpoint.html',
          controller: 'EndpointController'
        },
-        "sidebar@": {
+        'sidebar@': {
          templateUrl: 'app/components/sidebar/sidebar.html',
          controller: 'SidebarController'
        }
@@ -305,33 +393,24 @@ angular.module('portainer', [
    .state('endpoint.access', {
      url: '^/endpoints/:id/access',
      views: {
-        "content@": {
+        'content@': {
          templateUrl: 'app/components/endpointAccess/endpointAccess.html',
          controller: 'EndpointAccessController'
        },
-        "sidebar@": {
+        'sidebar@': {
          templateUrl: 'app/components/sidebar/sidebar.html',
          controller: 'SidebarController'
        }
      }
    })
-    .state('endpointInit', {
-      url: '/init/endpoint',
-      views: {
-        "content@": {
-          templateUrl: 'app/components/endpointInit/endpointInit.html',
-          controller: 'EndpointInitController'
-        }
-      }
-    })
    .state('events', {
      url: '/events/',
      views: {
-        "content@": {
+        'content@': {
          templateUrl: 'app/components/events/events.html',
          controller: 'EventsController'
        },
-        "sidebar@": {
+        'sidebar@': {
          templateUrl: 'app/components/sidebar/sidebar.html',
          controller: 'SidebarController'
        }
@@ -340,11 +419,11 @@ angular.module('portainer', [
    .state('images', {
      url: '/images/',
      views: {
-        "content@": {
+        'content@': {
          templateUrl: 'app/components/images/images.html',
          controller: 'ImagesController'
        },
-        "sidebar@": {
+        'sidebar@': {
          templateUrl: 'app/components/sidebar/sidebar.html',
          controller: 'SidebarController'
        }
@@ -353,11 +432,11 @@ angular.module('portainer', [
    .state('image', {
      url: '^/images/:id/',
      views: {
-        "content@": {
+        'content@': {
          templateUrl: 'app/components/image/image.html',
          controller: 'ImageController'
        },
-        "sidebar@": {
+        'sidebar@': {
          templateUrl: 'app/components/sidebar/sidebar.html',
          controller: 'SidebarController'
        }
@@ -366,11 +445,11 @@ angular.module('portainer', [
    .state('networks', {
      url: '/networks/',
      views: {
-        "content@": {
+        'content@': {
          templateUrl: 'app/components/networks/networks.html',
          controller: 'NetworksController'
        },
-        "sidebar@": {
+        'sidebar@': {
          templateUrl: 'app/components/sidebar/sidebar.html',
          controller: 'SidebarController'
        }
@@ -379,11 +458,11 @@ angular.module('portainer', [
    .state('network', {
      url: '^/networks/:id/',
      views: {
-        "content@": {
+        'content@': {
          templateUrl: 'app/components/network/network.html',
          controller: 'NetworkController'
        },
-        "sidebar@": {
+        'sidebar@': {
          templateUrl: 'app/components/sidebar/sidebar.html',
          controller: 'SidebarController'
        }
@@ -392,11 +471,76 @@ angular.module('portainer', [
    .state('node', {
      url: '^/nodes/:id/',
      views: {
-        "content@": {
+        'content@': {
          templateUrl: 'app/components/node/node.html',
          controller: 'NodeController'
        },
-        "sidebar@": {
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('registries', {
+      url: '/registries/',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/registries/registries.html',
+          controller: 'RegistriesController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('registry', {
+      url: '^/registries/:id',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/registry/registry.html',
+          controller: 'RegistryController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('registry.access', {
+      url: '^/registries/:id/access',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/registryAccess/registryAccess.html',
+          controller: 'RegistryAccessController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('secrets', {
+      url: '^/secrets/',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/secrets/secrets.html',
+          controller: 'SecretsController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('secret', {
+      url: '^/secret/:id/',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/secret/secret.html',
+          controller: 'SecretController'
+        },
+        'sidebar@': {
          templateUrl: 'app/components/sidebar/sidebar.html',
          controller: 'SidebarController'
        }
@@ -405,11 +549,11 @@ angular.module('portainer', [
    .state('services', {
      url: '/services/',
      views: {
-        "content@": {
+        'content@': {
          templateUrl: 'app/components/services/services.html',
          controller: 'ServicesController'
        },
-        "sidebar@": {
+        'sidebar@': {
          templateUrl: 'app/components/sidebar/sidebar.html',
          controller: 'SidebarController'
        }
@@ -418,11 +562,11 @@ angular.module('portainer', [
    .state('service', {
      url: '^/service/:id/',
      views: {
-        "content@": {
+        'content@': {
          templateUrl: 'app/components/service/service.html',
          controller: 'ServiceController'
        },
-        "sidebar@": {
+        'sidebar@': {
          templateUrl: 'app/components/sidebar/sidebar.html',
          controller: 'SidebarController'
        }
@@ -431,11 +575,24 @@ angular.module('portainer', [
    .state('settings', {
      url: '/settings/',
      views: {
-        "content@": {
+        'content@': {
          templateUrl: 'app/components/settings/settings.html',
          controller: 'SettingsController'
        },
-        "sidebar@": {
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('settings_authentication', {
+      url: '^/settings/authentication',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/settingsAuthentication/settingsAuthentication.html',
+          controller: 'SettingsAuthenticationController'
+        },
+        'sidebar@': {
          templateUrl: 'app/components/sidebar/sidebar.html',
          controller: 'SidebarController'
        }
@@ -444,11 +601,11 @@ angular.module('portainer', [
    .state('task', {
      url: '^/task/:id',
      views: {
-        "content@": {
+        'content@': {
          templateUrl: 'app/components/task/task.html',
          controller: 'TaskController'
        },
-        "sidebar@": {
+        'sidebar@': {
          templateUrl: 'app/components/sidebar/sidebar.html',
          controller: 'SidebarController'
        }
@@ -461,11 +618,11 @@ angular.module('portainer', [
        hide_descriptions: false
      },
      views: {
-        "content@": {
+        'content@': {
          templateUrl: 'app/components/templates/templates.html',
          controller: 'TemplatesController'
        },
-        "sidebar@": {
+        'sidebar@': {
          templateUrl: 'app/components/sidebar/sidebar.html',
          controller: 'SidebarController'
        }
@@ -478,11 +635,11 @@ angular.module('portainer', [
        hide_descriptions: true
      },
      views: {
-        "content@": {
+        'content@': {
          templateUrl: 'app/components/templates/templates.html',
          controller: 'TemplatesController'
        },
-        "sidebar@": {
+        'sidebar@': {
          templateUrl: 'app/components/sidebar/sidebar.html',
          controller: 'SidebarController'
        }
@@ -491,11 +648,24 @@ angular.module('portainer', [
    .state('volumes', {
      url: '/volumes/',
      views: {
-        "content@": {
+        'content@': {
          templateUrl: 'app/components/volumes/volumes.html',
          controller: 'VolumesController'
        },
-        "sidebar@": {
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('volume', {
+      url: '^/volumes/:id',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/volume/volume.html',
+          controller: 'VolumeController'
+        },
+        'sidebar@': {
          templateUrl: 'app/components/sidebar/sidebar.html',
          controller: 'SidebarController'
        }
@@ -504,11 +674,11 @@ angular.module('portainer', [
    .state('users', {
      url: '/users/',
      views: {
-        "content@": {
+        'content@': {
          templateUrl: 'app/components/users/users.html',
          controller: 'UsersController'
        },
-        "sidebar@": {
+        'sidebar@': {
          templateUrl: 'app/components/sidebar/sidebar.html',
          controller: 'SidebarController'
        }
@@ -517,48 +687,84 @@ angular.module('portainer', [
    .state('user', {
      url: '^/users/:id',
      views: {
-        "content@": {
+        'content@': {
          templateUrl: 'app/components/user/user.html',
          controller: 'UserController'
        },
-        "sidebar@": {
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('userSettings', {
+      url: '/userSettings/',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/userSettings/userSettings.html',
+          controller: 'UserSettingsController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('teams', {
+      url: '/teams/',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/teams/teams.html',
+          controller: 'TeamsController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('team', {
+      url: '^/teams/:id',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/team/team.html',
+          controller: 'TeamController'
+        },
+        'sidebar@': {
          templateUrl: 'app/components/sidebar/sidebar.html',
          controller: 'SidebarController'
        }
      }
    })
    .state('swarm', {
-      url: '/swarm/',
+      url: '/swarm',
      views: {
-        "content@": {
+        'content@': {
          templateUrl: 'app/components/swarm/swarm.html',
          controller: 'SwarmController'
        },
-        "sidebar@": {
+        'sidebar@': {
          templateUrl: 'app/components/sidebar/sidebar.html',
          controller: 'SidebarController'
        }
      }
-    });
-
-    // The Docker API likes to return plaintext errors, this catches them and disp
-    $httpProvider.interceptors.push(function() {
-      return {
-        'response': function(response) {
-          if (typeof(response.data) === 'string' &&
-          (_.startsWith(response.data, 'Conflict.') || _.startsWith(response.data, 'conflict:'))) {
-            $.gritter.add({
-              title: 'Error',
-              text: $('<div>').text(response.data).html(),
-              time: 10000
-            });
-          }
-          return response;
+    })
+    .state('swarm.visualizer', {
+      url: '/visualizer',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/swarmVisualizer/swarmVisualizer.html',
+          controller: 'SwarmVisualizerController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
        }
-      };
-    });
+      }
+    })
+    ;
  }])
-  .run(['$rootScope', '$state', 'Authentication', 'authManager', 'StateManager', 'EndpointProvider', 'Messages', 'Analytics', function ($rootScope, $state, Authentication, authManager, StateManager, EndpointProvider, Messages, Analytics) {
+  .run(['$rootScope', '$state', 'Authentication', 'authManager', 'StateManager', 'EndpointProvider', 'Notifications', 'Analytics', function ($rootScope, $state, Authentication, authManager, StateManager, EndpointProvider, Notifications, Analytics) {
    EndpointProvider.initialize();
    StateManager.initialize().then(function success(state) {
      if (state.application.authentication) {
@@ -579,19 +785,24 @@ angular.module('portainer', [
        });
      }
    }, function error(err) {
-      Messages.error("Failure", err, 'Unable to retrieve application settings');
+      Notifications.error('Failure', err, 'Unable to retrieve application settings');
    });

    $rootScope.$state = $state;
  }])
  // This is your docker url that the api will use to make requests
  // You need to set this to the api endpoint without the port i.e. http://192.168.1.9
-  .constant('DOCKER_PORT', '') // Docker port, leave as an empty string if no port is required.  If you have a port, prefix it with a ':' i.e. :4243
-  .constant('DOCKER_ENDPOINT', 'api/docker')
-  .constant('CONFIG_ENDPOINT', 'api/settings')
-  .constant('AUTH_ENDPOINT', 'api/auth')
-  .constant('USERS_ENDPOINT', 'api/users')
-  .constant('ENDPOINTS_ENDPOINT', 'api/endpoints')
-  .constant('TEMPLATES_ENDPOINT', 'api/templates')
-  .constant('PAGINATION_MAX_ITEMS', 10)
-  .constant('UI_VERSION', 'v1.12.3');
+  // .constant('DOCKER_PORT', '') // Docker port, leave as an empty string if no port is required.  If you have a port, prefix it with a ':' i.e. :4243
+  .constant('API_ENDPOINT_AUTH', 'api/auth')
+  .constant('API_ENDPOINT_DOCKERHUB', 'api/dockerhub')
+  .constant('API_ENDPOINT_ENDPOINTS', 'api/endpoints')
+  .constant('API_ENDPOINT_REGISTRIES', 'api/registries')
+  .constant('API_ENDPOINT_RESOURCE_CONTROLS', 'api/resource_controls')
+  .constant('API_ENDPOINT_SETTINGS', 'api/settings')
+  .constant('API_ENDPOINT_STATUS', 'api/status')
+  .constant('API_ENDPOINT_USERS', 'api/users')
+  .constant('API_ENDPOINT_TEAMS', 'api/teams')
+  .constant('API_ENDPOINT_TEAM_MEMBERSHIPS', 'api/team_memberships')
+  .constant('API_ENDPOINT_TEMPLATES', 'api/templates')
+  .constant('DEFAULT_TEMPLATES_URL', 'https://raw.githubusercontent.com/portainer/templates/master/templates.json')
+  .constant('PAGINATION_MAX_ITEMS', 10);
@@ -1,92 +1,38 @@
 <div class="page-wrapper">
  <!-- login box -->
  <div class="container simple-box">
-    <div class="col-md-6 col-md-offset-3 col-sm-6 col-sm-offset-3">
+    <div class="col-sm-6 col-sm-offset-3">
      <!-- login box logo -->
      <div class="row">
-        <img ng-if="logo" ng-src="{{ logo }}" class="simple-box-logo">
        <img ng-if="!logo" src="images/logo_alt.png" class="simple-box-logo" alt="Portainer">
+        <img ng-if="logo" ng-src="{{ logo }}" class="simple-box-logo">
      </div>
      <!-- !login box logo -->
-      <!-- init password panel -->
-      <div class="panel panel-default" ng-if="initPassword">
-        <div class="panel-body">
-          <!-- init password form -->
-          <form class="login-form form-horizontal" enctype="multipart/form-data" method="POST">
-            <!-- comment -->
-            <div class="input-group">
-              <p style="margin: 5px;">
-                Please specify a password for the <b>admin</b> user account.
-              </p>
-            </div>
-            <!-- !comment input -->
-            <!-- comment -->
-            <div class="input-group">
-              <p style="margin: 5px;">
-                <i ng-class="{true: 'fa fa-check green-icon', false: 'fa fa-times red-icon'}[initPasswordData.password.length >= 8]" aria-hidden="true"></i>
-                Your password must be at least 8 characters long
-              </p>
-            </div>
-            <!-- !comment input -->
-            <!-- password input -->
-            <div class="input-group">
-              <span class="input-group-addon"><i class="fa fa-lock" aria-hidden="true"></i></span>
-              <input id="admin_password" type="password" class="form-control" name="password" ng-model="initPasswordData.password" autofocus>
-            </div>
-            <!-- !password input -->
-            <!-- comment -->
-            <div class="input-group">
-              <p style="margin: 5px;">
-                <i ng-class="{true: 'fa fa-check green-icon', false: 'fa fa-times red-icon'}[initPasswordData.password !== '' && initPasswordData.password === initPasswordData.password_confirmation]" aria-hidden="true"></i>
-                Confirm your password
-              </p>
-            </div>
-            <!-- !comment input -->
-            <!-- password confirmation input -->
-            <div class="input-group">
-              <span class="input-group-addon"><i class="fa fa-lock" aria-hidden="true"></i></span>
-              <input id="password_confirmation" type="password" class="form-control" name="password" ng-model="initPasswordData.password_confirmation">
-            </div>
-            <!-- !password confirmation input -->
-            <!-- validate button -->
-            <div class="form-group">
-              <div class="col-sm-12 controls">
-                <p class="pull-left text-danger" ng-if="initPasswordData.error" style="margin: 5px;">
-                  <i class="fa fa-exclamation-circle" aria-hidden="true"></i> Unable to create default user
-                </p>
-                <button type="submit" class="btn btn-primary pull-right" ng-disabled="initPasswordData.password.length < 8 || initPasswordData.password !== initPasswordData.password_confirmation" ng-click="createAdminUser()"><i class="fa fa-key" aria-hidden="true"></i> Validate</button>
-              </div>
-            </div>
-            <!-- !validate button -->
-          </form>
-          <!-- !init password form -->
-        </div>
-      </div>
-      <!-- !init password panel -->
      <!-- login panel -->
-      <div class="panel panel-default" ng-if="!initPassword">
+      <div class="panel panel-default">
        <div class="panel-body">
          <!-- login form -->
-          <form class="login-form form-horizontal" enctype="multipart/form-data" method="POST">
+          <form class="simple-box-form form-horizontal">
            <!-- username input -->
            <div class="input-group">
              <span class="input-group-addon"><i class="fa fa-user" aria-hidden="true"></i></span>
-              <input id="username" type="text" class="form-control" name="username" ng-model="authData.username" placeholder="Username">
+              <input id="username" type="text" class="form-control" name="username" ng-model="formValues.Username" auto-focus>
            </div>
            <!-- !username input -->
            <!-- password input -->
            <div class="input-group">
              <span class="input-group-addon"><i class="fa fa-lock" aria-hidden="true"></i></span>
-              <input id="password" type="password" class="form-control" name="password" ng-model="authData.password" autofocus>
+              <input id="password" type="password" class="form-control" name="password" ng-model="formValues.Password">
            </div>
            <!-- !password input -->
            <!-- login button -->
            <div class="form-group">
-              <div class="col-sm-12 controls">
-                <p class="pull-left text-danger" ng-if="authData.error" style="margin: 5px;">
-                  <i class="fa fa-exclamation-circle" aria-hidden="true"></i> {{ authData.error }}
-                </p>
-                <button type="submit" class="btn btn-primary pull-right" ng-click="authenticateUser()"><i class="fa fa-sign-in" aria-hidden="true"></i> Login</button>
+              <div class="col-sm-12">
+                <button type="submit" class="btn btn-primary btn-sm pull-right" ng-click="authenticateUser()"><i class="fa fa-sign-in" aria-hidden="true"></i> Login</button>
+                <span class="pull-left" style="margin: 5px;" ng-if="state.AuthenticationError">
+                  <i class="fa fa-exclamation-triangle red-icon" aria-hidden="true" style="margin-right: 2px;"></i>
+                  <span class="small text-danger">{{ state.AuthenticationError }}</span>
+                </span>
              </div>
            </div>
            <!-- !login button -->
@@ -1,115 +1,110 @@
 angular.module('auth', [])
-.controller('AuthenticationController', ['$scope', '$state', '$stateParams', '$window', '$timeout', '$sanitize', 'Config', 'Authentication', 'Users', 'EndpointService', 'StateManager', 'EndpointProvider', 'Messages',
-function ($scope, $state, $stateParams, $window, $timeout, $sanitize, Config, Authentication, Users, EndpointService, StateManager, EndpointProvider, Messages) {
+.controller('AuthenticationController', ['$scope', '$state', '$stateParams', '$window', '$timeout', '$sanitize', 'Authentication', 'Users', 'UserService', 'EndpointService', 'StateManager', 'EndpointProvider', 'Notifications', 'SettingsService',
+function ($scope, $state, $stateParams, $window, $timeout, $sanitize, Authentication, Users, UserService, EndpointService, StateManager, EndpointProvider, Notifications, SettingsService) {

-  $scope.authData = {
-    username: 'admin',
-    password: '',
-    error: ''
-  };
-  $scope.initPasswordData = {
-    password: '',
-    password_confirmation: '',
-    error: false
+  $scope.logo = StateManager.getState().application.logo;
+
+  $scope.formValues = {
+    Username: '',
+    Password: ''
  };

-  if (!$scope.applicationState.application.authentication) {
+  $scope.state = {
+    AuthenticationError: ''
+  };
+
+  function setActiveEndpointAndRedirectToDashboard(endpoint) {
+    var endpointID = EndpointProvider.endpointID();
+    if (!endpointID) {
+      EndpointProvider.setEndpointID(endpoint.Id);
+    }
+    StateManager.updateEndpointState(true)
+    .then(function success(data) {
+      $state.go('dashboard');
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to connect to the Docker endpoint');
+    });
+  }
+
+  function unauthenticatedFlow() {
    EndpointService.endpoints()
    .then(function success(data) {
-      if (data.length > 0)  {
-        endpointID = EndpointProvider.endpointID();
-        if (!endpointID) {
-          endpointID = data[0].Id;
-          EndpointProvider.setEndpointID(endpointID);
-        }
-        StateManager.updateEndpointState(true)
-        .then(function success() {
-          $state.go('dashboard');
-        }, function error(err) {
-          Messages.error("Failure", err, 'Unable to connect to the Docker endpoint');
-        });
-      }
-      else {
-        $state.go('endpointInit');
-      }
-    }, function error(err) {
-      Messages.error("Failure", err, 'Unable to retrieve endpoints');
-    });
-  } else {
-    Users.checkAdminUser({}, function () {},
-    function (e) {
-      if (e.status === 404) {
-        $scope.initPassword = true;
+      var endpoints = data;
+      if (endpoints.length > 0)  {
+        setActiveEndpointAndRedirectToDashboard(endpoints[0]);
      } else {
-        Messages.error("Failure", e, 'Unable to verify administrator account existence');
-      }
-    });
-  }
-
-  if ($stateParams.logout) {
-    Authentication.logout();
-  }
-
-  if ($stateParams.error) {
-    $scope.authData.error = $stateParams.error;
-    Authentication.logout();
-  }
-
-  if (Authentication.isAuthenticated()) {
-    $state.go('dashboard');
-  }
-
-  Config.$promise.then(function (c) {
-    $scope.logo = c.logo;
-  });
-
-  $scope.createAdminUser = function() {
-    var password = $sanitize($scope.initPasswordData.password);
-    Users.initAdminUser({password: password}, function (d) {
-      $scope.initPassword = false;
-      $timeout(function() {
-        var element = $window.document.getElementById('password');
-        if(element) {
-          element.focus();
-        }
-      });
-    }, function (e) {
-      $scope.initPassword.error = true;
-    });
-  };
-
-  $scope.authenticateUser = function() {
-    $scope.authenticationError = false;
-    var username = $sanitize($scope.authData.username);
-    var password = $sanitize($scope.authData.password);
-    Authentication.login(username, password)
-    .then(function success(data) {
-      return EndpointService.endpoints();
-    })
-    .then(function success(data) {
-      var userDetails = Authentication.getUserDetails();
-      if (data.length > 0)  {
-        endpointID = EndpointProvider.endpointID();
-        if (!endpointID) {
-          endpointID = data[0].Id;
-          EndpointProvider.setEndpointID(endpointID);
-        }
-        StateManager.updateEndpointState(true)
-        .then(function success() {
-          $state.go('dashboard');
-        }, function error(err) {
-          Messages.error("Failure", err, 'Unable to connect to the Docker endpoint');
-        });
-      }
-      else if (data.length === 0 && userDetails.role === 1) {
-        $state.go('endpointInit');
-      } else if (data.length === 0 && userDetails.role === 2) {
-        Authentication.logout();
-        $scope.authData.error = 'User not allowed. Please contact your administrator.';
+        $state.go('init.endpoint');
      }
    })
    .catch(function error(err) {
-      $scope.authData.error = 'Authentication error';
+      Notifications.error('Failure', err, 'Unable to retrieve endpoints');
+    });
+  }
+
+  function authenticatedFlow() {
+    UserService.administratorExists()
+    .then(function success(exists) {
+      if (!exists) {
+        $state.go('init.admin');
+      }
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to verify administrator account existence');
+    });
+  }
+
+  $scope.authenticateUser = function() {
+    var username = $scope.formValues.Username;
+    var password = $scope.formValues.Password;
+
+    SettingsService.publicSettings()
+    .then(function success(data) {
+      var settings = data;
+      if (settings.AuthenticationMethod === 1) {
+        username = $sanitize(username);
+        password = $sanitize(password);
+      }
+      return Authentication.login(username, password);
+    })
+    .then(function success() {
+      return EndpointService.endpoints();
+    })
+    .then(function success(data) {
+      var endpoints = data;
+      var userDetails = Authentication.getUserDetails();
+      if (endpoints.length > 0)  {
+        setActiveEndpointAndRedirectToDashboard(endpoints[0]);
+      } else if (endpoints.length === 0 && userDetails.role === 1) {
+        $state.go('init.endpoint');
+      } else if (endpoints.length === 0 && userDetails.role === 2) {
+        Authentication.logout();
+        $scope.state.AuthenticationError = 'User not allowed. Please contact your administrator.';
+      }
+    })
+    .catch(function error() {
+      $scope.state.AuthenticationError = 'Invalid credentials';
    });
  };
+
+  function initView() {
+    if ($stateParams.logout || $stateParams.error) {
+      Authentication.logout();
+      $scope.state.AuthenticationError = $stateParams.error;
+      return;
+    }
+
+    if (Authentication.isAuthenticated()) {
+      $state.go('dashboard');
+    }
+
+    var authenticationEnabled = $scope.applicationState.application.authentication;
+    if (!authenticationEnabled) {
+      unauthenticatedFlow();
+    } else {
+      authenticatedFlow();
+    }
+  }
+
+  initView();
 }]);
@@ -3,7 +3,7 @@
    <i id="loadingViewSpinner" class="fa fa-cog fa-spin"></i>
  </rd-header-title>
  <rd-header-content>
-    <a ui-sref="containers">Containers</a> > <a ui-sref="container({id: container.Id})">{{ container.Name|trimcontainername }}</a>
+    <a ui-sref="containers">Containers</a> &gt; <a ui-sref="container({id: container.Id})">{{ container.Name|trimcontainername }}</a>
  </rd-header-content>
 </rd-header>

@@ -19,7 +19,9 @@
          <button class="btn btn-primary" ng-click="restart()" ng-disabled="!container.State.Running"><i class="fa fa-refresh space-right" aria-hidden="true"></i>Restart</button>
          <button class="btn btn-primary" ng-click="pause()" ng-disabled="!container.State.Running || container.State.Paused"><i class="fa fa-pause space-right" aria-hidden="true"></i>Pause</button>
          <button class="btn btn-primary" ng-click="unpause()" ng-disabled="!container.State.Paused"><i class="fa fa-play space-right" aria-hidden="true"></i>Resume</button>
-          <button class="btn btn-danger" ng-click="remove()" ng-disabled="container.State.Running"><i class="fa fa-trash space-right" aria-hidden="true"></i>Remove</button>
+          <button class="btn btn-danger" ng-click="confirmRemove()"><i class="fa fa-trash space-right" aria-hidden="true"></i>Remove</button>
+          <button class="btn btn-danger" ng-click="recreate()" ng-if="!container.Config.Labels['com.docker.swarm.service.id']"><i class="fa fa-refresh space-right" aria-hidden="true"></i>Recreate</button>
+          <button class="btn btn-primary" ng-click="duplicate()" ng-if="!container.Config.Labels['com.docker.swarm.service.id']"><i class="fa fa-files-o space-right" aria-hidden="true"></i>Duplicate/Edit</button>
        </div>
      </rd-widget-body>
    </rd-widget>
@@ -33,6 +35,10 @@
      <rd-widget-body classes="no-padding">
        <table class="table">
          <tbody>
+            <tr>
+              <td>ID</td>
+              <td>{{ container.Id }}</td>
+            </tr>
            <tr>
              <td>Name</td>
              <td ng-if="!container.edit">
@@ -54,15 +60,20 @@
            <tr>
              <td>Status</td>
              <td>
-                <i ng-class="{true: 'fa fa-heartbeat space-right green-icon', false: 'fa fa-heartbeat space-right red-icon'}[container.State.Running]"></i>
-                {{ container.State|getstatetext }} since {{ activityTime }}<span ng-if="!container.State.Running"> with exit code {{ container.State.ExitCode }}</span>
+                <i class="fa fa-heartbeat space-right green-icon" ng-if="container.State.Running"></i>
+                <i class="fa fa-heartbeat space-right red-icon" ng-if="!container.State.Running && container.State.Status !== 'created'"></i>
+                {{ container.State|getstatetext }} since {{ activityTime }}<span ng-if="!container.State.Running && container.State.Status !== 'created'"> with exit code {{ container.State.ExitCode }}</span>
              </td>
            </tr>
+            <tr>
+              <td>Created</td>
+              <td>{{ container.Created|getisodate }}</td>
+            </tr>
            <tr ng-if="container.State.Running">
              <td>Start time</td>
              <td>{{ container.State.StartedAt|getisodate }}</td>
            </tr>
-            <tr ng-if="!container.State.Running">
+            <tr ng-if="!container.State.Running && container.State.Status !== 'created'">
              <td>Finished</td>
              <td>{{ container.State.FinishedAt|getisodate }}</td>
            </tr>
@@ -70,7 +81,7 @@
              <td colspan="2">
                <div class="btn-group" role="group" aria-label="...">
                  <a class="btn btn-outline-secondary" type="button" ui-sref="stats({id: container.Id})"><i class="fa fa-area-chart space-right" aria-hidden="true"></i>Stats</a>
-                  <a class="btn btn-outline-secondary" type="button" ui-sref="logs({id: container.Id})"><i class="fa fa-exclamation-circle space-right" aria-hidden="true"></i>Logs</a>
+                  <a class="btn btn-outline-secondary" type="button" ui-sref="containerlogs({id: container.Id})"><i class="fa fa-exclamation-circle space-right" aria-hidden="true"></i>Logs</a>
                  <a class="btn btn-outline-secondary" type="button" ui-sref="console({id: container.Id})"><i class="fa fa-terminal space-right" aria-hidden="true"></i>Console</a>
                </div>
              </td>
@@ -82,6 +93,44 @@
  </div>
 </div>

+<!-- access-control-panel -->
+<por-access-control-panel
+  ng-if="container && applicationState.application.authentication"
+  resource-id="container.Id"
+  resource-control="container.ResourceControl"
+  resource-type="'container'">
+</por-access-control-panel>
+<!-- !access-control-panel -->
+
+<div ng-if="container.State.Health" class="row">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-header icon="fa-server" title="Container health"></rd-widget-header>
+      <rd-widget-body classes="no-padding">
+        <table class="table">
+          <tbody>
+            <tr>
+              <td>Status</td>
+              <td>
+                <i ng-class="{'healthy': 'fa fa-heartbeat space-right green-icon', 'unhealthy': 'fa fa-heartbeat space-right red-icon', 'starting': 'fa fa-heartbeat space-right orange-icon'}[container.State.Health.Status]"></i>
+                {{ container.State.Health.Status }}
+              </td>
+            </tr>
+            <tr>
+              <td>Failure count</td>
+              <td>{{ container.State.Health.FailingStreak }}</td>
+            </tr>
+            <tr>
+              <td>Last output</td>
+              <td>{{ container.State.Health.Log[container.State.Health.Log.length - 1].Output }}</td>
+            </tr>
+          </tbody>
+        </table>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
+
 <div class="row">
  <div class="col-lg-12 col-md-12 col-xs-12">
    <rd-widget>
@@ -98,21 +147,11 @@
            </div>
          </div>
          <!-- !tag-description -->
-          <!-- name-and-registry-inputs -->
+          <!-- image-and-registry -->
          <div class="form-group">
-            <label for="image_name" class="col-sm-1 control-label text-left">Name</label>
-            <div class="col-sm-11 col-md-6">
-              <input type="text" class="form-control" ng-model="config.Image" id="image_name" placeholder="e.g. myImage:myTag">
-            </div>
-            <label for="image_registry" class="col-sm-2 margin-sm-top control-label text-left">
-              Registry
-              <portainer-tooltip position="bottom" message="A registry to pull the image from. Leave empty to use the official Docker registry."></portainer-tooltip>
-            </label>
-            <div class="col-sm-10 col-md-3 margin-sm-top">
-              <input type="text" class="form-control" ng-model="config.Registry" id="image_registry" placeholder="optional">
-            </div>
+            <por-image-registry image="config.Image" registry="config.Registry"></por-image-registry>
          </div>
-          <!-- !name-and-registry-inputs -->
+          <!-- !image-and-registry -->
          <!-- tag-note -->
          <div class="form-group">
            <div class="col-sm-12">
@@ -159,7 +198,7 @@
              <td>ENV</td>
              <td>
                <table class="table table-bordered table-condensed">
-                  <tr ng-repeat="var in container.Config.Env">
+                  <tr ng-repeat="var in container.Config.Env track by $index">
                    <td>{{ var|key: '=' }}</td>
                    <td>{{ var|value: '=' }}</td>
                  </tr>
@@ -225,7 +264,7 @@
  </div>
 </div>

-<div class="row" ng-if="!(container.NetworkSettings.Networks | emptyobject)">
+<div class="row">
  <div class="col-lg-12 col-md-12 col-xs-12">
    <rd-widget>
      <rd-widget-header icon="fa-sitemap" title="Connected networks">
@@ -259,11 +298,30 @@
                <button type="button" class="btn btn-xs btn-danger" ng-click="containerLeaveNetwork(container, value.NetworkID)"><i class="fa fa-trash space-right" aria-hidden="true"></i>Leave Network</button>
              </td>
            </tr>
+            <tr ng-if="(container.NetworkSettings.Networks | emptyobject)">
+              <td colspan="5" class="text-center text-muted">No networks connected.</td>
+            </tr>
          </tbody>
        </table>
        <div class="pagination-controls">
          <dir-pagination-controls></dir-pagination-controls>
        </div>
+        <hr />
+        <form class="form-horizontal">
+          <!-- network-input -->
+          <div class="row">
+            <label for="container_network" class="col-sm-3 col-lg-2 control-label text-left">Join a Network</label>
+            <div class="col-sm-5 col-lg-4">
+              <select class="form-control" ng-model="selectedNetwork" id="container_network">
+                <option selected disabled hidden value="">Select a network</option>
+                <option ng-repeat="net in availableNetworks" ng-value="net.Id">{{ net.Name }}</option>
+              </select>
+            </div>
+            <div class="col-sm-1">
+              <button type="button" class="btn btn-primary btn-sm" ng-disabled="!selectedNetwork" ng-click="containerJoinNetwork(container, selectedNetwork)">Join Network</button>
+            </div>
+          </div>
+        </form>
      </rd-widget-body>
    </rd-widget>
  </div>
@@ -1,6 +1,6 @@
 angular.module('container', [])
-.controller('ContainerController', ['$scope', '$state','$stateParams', '$filter', 'Container', 'ContainerCommit', 'ImageHelper', 'Network', 'Messages', 'Pagination',
-function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, ImageHelper, Network, Messages, Pagination) {
+.controller('ContainerController', ['$q', '$scope', '$state','$stateParams', '$filter', 'Container', 'ContainerCommit', 'ContainerHelper', 'ContainerService', 'ImageHelper', 'Network', 'NetworkService', 'Notifications', 'Pagination', 'ModalService', 'ResourceControlService', 'RegistryService', 'ImageService',
+function ($q, $scope, $state, $stateParams, $filter, Container, ContainerCommit, ContainerHelper, ContainerService, ImageHelper, Network, NetworkService, Notifications, Pagination, ModalService, ResourceControlService, RegistryService, ImageService) {
  $scope.activityTime = 0;
  $scope.portBindings = [];
  $scope.config = {
@@ -17,23 +17,26 @@ function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, Ima
  var update = function () {
    $('#loadingViewSpinner').show();
    Container.get({id: $stateParams.id}, function (d) {
-      $scope.container = d;
+      var container = new ContainerDetailsViewModel(d);
+      $scope.container = container;
      $scope.container.edit = false;
-      $scope.container.newContainerName = $filter('trimcontainername')(d.Name);
+      $scope.container.newContainerName = $filter('trimcontainername')(container.Name);

-      if (d.State.Running) {
-        $scope.activityTime = moment.duration(moment(d.State.StartedAt).utc().diff(moment().utc())).humanize();
+      if (container.State.Running) {
+        $scope.activityTime = moment.duration(moment(container.State.StartedAt).utc().diff(moment().utc())).humanize();
+      } else if (container.State.Status === 'created') {
+        $scope.activityTime = moment.duration(moment(container.Created).utc().diff(moment().utc())).humanize();
      } else {
-        $scope.activityTime = moment.duration(moment().utc().diff(moment(d.State.FinishedAt).utc())).humanize();
+        $scope.activityTime = moment.duration(moment().utc().diff(moment(container.State.FinishedAt).utc())).humanize();
      }

      $scope.portBindings = [];
-      if (d.NetworkSettings.Ports) {
-        angular.forEach(Object.keys(d.NetworkSettings.Ports), function(portMapping) {
-          if (d.NetworkSettings.Ports[portMapping]) {
+      if (container.NetworkSettings.Ports) {
+        angular.forEach(Object.keys(container.NetworkSettings.Ports), function(portMapping) {
+          if (container.NetworkSettings.Ports[portMapping]) {
            var mapping = {};
            mapping.container = portMapping;
-            mapping.host = d.NetworkSettings.Ports[portMapping][0].HostIp + ':' + d.NetworkSettings.Ports[portMapping][0].HostPort;
+            mapping.host = container.NetworkSettings.Ports[portMapping][0].HostIp + ':' + container.NetworkSettings.Ports[portMapping][0].HostPort;
            $scope.portBindings.push(mapping);
          }
        });
@@ -41,7 +44,7 @@ function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, Ima
      $('#loadingViewSpinner').hide();
    }, function (e) {
      $('#loadingViewSpinner').hide();
-      Messages.error("Failure", e, "Unable to retrieve container info");
+      Notifications.error('Failure', e, 'Unable to retrieve container info');
    });
  };

@@ -49,10 +52,10 @@ function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, Ima
    $('#loadingViewSpinner').show();
    Container.start({id: $scope.container.Id}, {}, function (d) {
      update();
-      Messages.send("Container started", $stateParams.id);
+      Notifications.success('Container started', $stateParams.id);
    }, function (e) {
      update();
-      Messages.error("Failure", e, "Unable to start container");
+      Notifications.error('Failure', e, 'Unable to start container');
    });
  };

@@ -60,10 +63,10 @@ function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, Ima
    $('#loadingViewSpinner').show();
    Container.stop({id: $stateParams.id}, function (d) {
      update();
-      Messages.send("Container stopped", $stateParams.id);
+      Notifications.success('Container stopped', $stateParams.id);
    }, function (e) {
      update();
-      Messages.error("Failure", e, "Unable to stop container");
+      Notifications.error('Failure', e, 'Unable to stop container');
    });
  };

@@ -71,10 +74,10 @@ function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, Ima
    $('#loadingViewSpinner').show();
    Container.kill({id: $stateParams.id}, function (d) {
      update();
-      Messages.send("Container killed", $stateParams.id);
+      Notifications.success('Container killed', $stateParams.id);
    }, function (e) {
      update();
-      Messages.error("Failure", e, "Unable to kill container");
+      Notifications.error('Failure', e, 'Unable to kill container');
    });
  };

@@ -82,15 +85,15 @@ function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, Ima
    $('#createImageSpinner').show();
    var image = $scope.config.Image;
    var registry = $scope.config.Registry;
-    var imageConfig = ImageHelper.createImageConfigForCommit(image, registry);
+    var imageConfig = ImageHelper.createImageConfigForCommit(image, registry.URL);
    ContainerCommit.commit({id: $stateParams.id, tag: imageConfig.tag, repo: imageConfig.repo}, function (d) {
      $('#createImageSpinner').hide();
      update();
-      Messages.send("Container commited", $stateParams.id);
+      Notifications.success('Container commited', $stateParams.id);
    }, function (e) {
      $('#createImageSpinner').hide();
      update();
-      Messages.error("Failure", e, "Unable to commit container");
+      Notifications.error('Failure', e, 'Unable to commit container');
    });
  };

@@ -98,10 +101,10 @@ function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, Ima
    $('#loadingViewSpinner').show();
    Container.pause({id: $stateParams.id}, function (d) {
      update();
-      Messages.send("Container paused", $stateParams.id);
+      Notifications.success('Container paused', $stateParams.id);
    }, function (e) {
      update();
-      Messages.error("Failure", e, "Unable to pause container");
+      Notifications.error('Failure', e, 'Unable to pause container');
    });
  };

@@ -109,27 +112,43 @@ function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, Ima
    $('#loadingViewSpinner').show();
    Container.unpause({id: $stateParams.id}, function (d) {
      update();
-      Messages.send("Container unpaused", $stateParams.id);
+      Notifications.success('Container unpaused', $stateParams.id);
    }, function (e) {
      update();
-      Messages.error("Failure", e, "Unable to unpause container");
+      Notifications.error('Failure', e, 'Unable to unpause container');
    });
  };

-  $scope.remove = function () {
+  $scope.confirmRemove = function () {
+    var title = 'You are about to remove a container.';
+    if ($scope.container.State.Running) {
+      title = 'You are about to remove a running container.';
+    }
+    ModalService.confirmContainerDeletion(
+      title,
+      function (result) {
+        if(!result) { return; }
+        var cleanAssociatedVolumes = false;
+        if (result[0]) {
+          cleanAssociatedVolumes = true;
+        }
+        $scope.remove(cleanAssociatedVolumes);
+      }
+    );
+  };
+
+  $scope.remove = function(cleanAssociatedVolumes) {
    $('#loadingViewSpinner').show();
-    Container.remove({id: $stateParams.id}, function (d) {
-      if (d.message) {
-        $('#loadingViewSpinner').hide();
-        Messages.send("Error", d.message);
-      }
-      else {
-        $state.go('containers', {}, {reload: true});
-        Messages.send("Container removed", $stateParams.id);
-      }
-    }, function (e) {
-      update();
-      Messages.error("Failure", e, "Unable to remove container");
+    ContainerService.remove($scope.container, cleanAssociatedVolumes)
+    .then(function success() {
+      Notifications.success('Container successfully removed');
+      $state.go('containers', {}, {reload: true});
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to remove container');
+    })
+    .finally(function final() {
+      $('#loadingViewSpinner').hide();
    });
  };

@@ -137,24 +156,25 @@ function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, Ima
    $('#loadingViewSpinner').show();
    Container.restart({id: $stateParams.id}, function (d) {
      update();
-      Messages.send("Container restarted", $stateParams.id);
+      Notifications.success('Container restarted', $stateParams.id);
    }, function (e) {
      update();
-      Messages.error("Failure", e, "Unable to restart container");
+      Notifications.error('Failure', e, 'Unable to restart container');
    });
  };

  $scope.renameContainer = function () {
-    Container.rename({id: $stateParams.id, 'name': $scope.container.newContainerName}, function (d) {
+    var container = $scope.container;
+    Container.rename({id: $stateParams.id, 'name': container.newContainerName}, function (d) {
      if (d.message) {
-        $scope.container.newContainerName = $scope.container.Name;
-        Messages.error("Unable to rename container", {}, d.message);
+        container.newContainerName = container.Name;
+        Notifications.error('Unable to rename container', {}, d.message);
      } else {
-        $scope.container.Name = $scope.container.newContainerName;
-        Messages.send("Container successfully renamed", d.name);
+        container.Name = container.newContainerName;
+        Notifications.success('Container successfully renamed', container.Name);
      }
    }, function (e) {
-      Messages.error("Failure", e, 'Unable to rename container');
+      Notifications.error('Failure', e, 'Unable to rename container');
    });
    $scope.container.edit = false;
  };
@@ -162,19 +182,134 @@ function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, Ima
  $scope.containerLeaveNetwork = function containerLeaveNetwork(container, networkId) {
    $('#loadingViewSpinner').show();
    Network.disconnect({id: networkId}, { Container: $stateParams.id, Force: false }, function (d) {
-      if (d.message) {
+      if (container.message) {
        $('#loadingViewSpinner').hide();
-        Messages.send("Error", {}, d.message);
+        Notifications.error('Error', d, 'Unable to disconnect container from network');
      } else {
        $('#loadingViewSpinner').hide();
-        Messages.send("Container left network", $stateParams.id);
+        Notifications.success('Container left network', $stateParams.id);
        $state.go('container', {id: $stateParams.id}, {reload: true});
      }
    }, function (e) {
      $('#loadingViewSpinner').hide();
-      Messages.error("Failure", e, "Unable to disconnect container from network");
+      Notifications.error('Failure', e, 'Unable to disconnect container from network');
    });
  };

+  $scope.duplicate = function() {
+    ModalService.confirmExperimentalFeature(function (experimental) {
+      if(!experimental) { return; }
+      $state.go('actions.create.container', {from: $stateParams.id}, {reload: true});
+    });
+  };
+
+  $scope.confirmRemove = function () {
+    var title = 'You are about to remove a container.';
+    if ($scope.container.State.Running) {
+      title = 'You are about to remove a running container.';
+    }
+    ModalService.confirmContainerDeletion(
+      title,
+      function (result) {
+        if(!result) { return; }
+        var cleanAssociatedVolumes = false;
+        if (result[0]) {
+          cleanAssociatedVolumes = true;
+        }
+        $scope.remove(cleanAssociatedVolumes);
+      }
+    );
+  };
+
+  function recreateContainer(pullImage) {
+    $('#loadingViewSpinner').show();
+    var container = $scope.container;
+    var config = ContainerHelper.configFromContainer(container.Model);
+    ContainerService.remove(container, true)
+    .then(function success() {
+      return RegistryService.retrieveRegistryFromRepository(container.Config.Image);
+    })
+    .then(function success(data) {
+      return $q.when(!pullImage || ImageService.pullImage(container.Config.Image, data, true));
+    })
+    .then(function success() {
+      return ContainerService.createAndStartContainer(config);
+    })
+    .then(function success(data) {
+      if (!container.ResourceControl) {
+        return true;
+      } else {
+        var containerIdentifier = data.Id;
+        var resourceControl = container.ResourceControl;
+        var users = resourceControl.UserAccesses.map(function(u) {
+          return u.UserId;
+        });
+        var teams = resourceControl.TeamAccesses.map(function(t) {
+          return t.TeamId;
+        });
+        return ResourceControlService.createResourceControl(resourceControl.AdministratorsOnly,
+          users, teams, containerIdentifier, 'container', []);
+      }
+    })
+    .then(function success(data) {
+      Notifications.success('Container successfully re-created');
+      $state.go('containers', {}, {reload: true});
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to re-create container');
+    })
+    .finally(function final() {
+      $('#loadingViewSpinner').hide();
+    });
+  }
+
+  $scope.recreate = function() {
+    ModalService.confirmExperimentalFeature(function (experimental) {
+      if(!experimental) { return; }
+
+      ModalService.confirmContainerRecreation(function (result) {
+        if(!result) { return; }
+        var pullImage = false;
+        if (result[0]) {
+          pullImage = true;
+        }
+        recreateContainer(pullImage);
+      });
+    });
+  };
+
+  $scope.containerJoinNetwork = function containerJoinNetwork(container, networkId) {
+    $('#joinNetworkSpinner').show();
+    Network.connect({id: networkId}, { Container: $stateParams.id }, function (d) {
+      if (container.message) {
+        $('#joinNetworkSpinner').hide();
+        Notifications.error('Error', d, 'Unable to connect container to network');
+      } else {
+        $('#joinNetworkSpinner').hide();
+        Notifications.success('Container joined network', $stateParams.id);
+        $state.go('container', {id: $stateParams.id}, {reload: true});
+      }
+    }, function (e) {
+      $('#joinNetworkSpinner').hide();
+      Notifications.error('Failure', e, 'Unable to connect container to network');
+    });
+  };
+
+  var provider = $scope.applicationState.endpoint.mode.provider;
+  var apiVersion = $scope.applicationState.endpoint.apiVersion;
+  NetworkService.networks(
+    provider === 'DOCKER_STANDALONE' || provider === 'DOCKER_SWARM_MODE',
+    false,
+    provider === 'DOCKER_SWARM_MODE' && apiVersion >= 1.25,
+    provider === 'DOCKER_SWARM'
+  )
+  .then(function success(data) {
+    var networks = data;
+    $scope.availableNetworks = networks;
+  })
+  .catch(function error(err) {
+    Notifications.error('Failure', err, 'Unable to retrieve networks');
+  });
+
  update();
 }]);
@@ -3,7 +3,7 @@
    <i id="loadingViewSpinner" class="fa fa-cog fa-spin"></i>
  </rd-header-title>
  <rd-header-content ng-if="state.loaded">
-    <a ui-sref="containers">Containers</a> > <a ui-sref="container({id: container.Id})">{{ container.Name|trimcontainername }}</a> > Console
+    <a ui-sref="containers">Containers</a> &gt; <a ui-sref="container({id: container.Id})">{{ container.Name|trimcontainername }}</a> &gt; Console
  </rd-header-content>
 </rd-header>

@@ -16,29 +16,53 @@
        </div>
      </rd-widget-header>
      <rd-widget-body>
-        <form>
-          <div class="row">
+        <form class="form-horizontal">
+          <div ng-if="!state.connected">
            <!-- command-list -->
-            <div class="col-sm-4">
-              <div class="input-group">
-                <span class="input-group-addon">
-                  <i class="fa fa-linux" aria-hidden="true" ng-if="imageOS == 'linux'"></i>
-                  <i class="fa fa-windows" aria-hidden="true" ng-if="imageOS == 'windows'"></i>
-                </span>
-                <select class="form-control" ng-model="state.command" id="command">
-                  <option value="bash" ng-if="imageOS == 'linux'">/bin/bash</option>
-                  <option value="sh" ng-if="imageOS == 'linux'">/bin/sh</option>
-                  <option value="powershell" ng-if="imageOS == 'windows'">powershell</option>
-                  <option value="cmd.exe" ng-if="imageOS == 'windows'">cmd.exe</option>
-                </select>
+              <div class="form-group">
+                <label for="command" class="col-lg-1 text-left col-sm-2 control-label">Command</label>
+                <div class="col-lg-11 col-sm-10">
+                  <div class="input-group" ng-if="!formValues.isCustomCommand">
+                    <span class="input-group-addon">
+                      <i class="fa fa-linux" aria-hidden="true" ng-if="imageOS == 'linux'"></i>
+                      <i class="fa fa-windows" aria-hidden="true" ng-if="imageOS == 'windows'"></i>
+                    </span>
+                    <select class="form-control" ng-model="formValues.command" id="command">
+                      <option value="bash" ng-if="imageOS == 'linux'">/bin/bash</option>
+                      <option value="sh" ng-if="imageOS == 'linux'">/bin/sh</option>
+                      <option value="powershell" ng-if="imageOS == 'windows'">powershell</option>
+                      <option value="cmd.exe" ng-if="imageOS == 'windows'">cmd.exe</option>
+                    </select>
+                  </div>
+                  <input class="form-control" ng-if="formValues.isCustomCommand" type="text" name="custom-command" ng-model="formValues.customCommand" placeholder="e.g. ps aux">
+                </div>
+              </div>
+            <!-- !command-list -->
+            <div class="form-group col-lg-12">
+              <label for="command" class="text-left control-label">Use custom command</label>
+              <label class="switch" style="margin-left: 20px;">
+                <input type="checkbox" ng-model="formValues.isCustomCommand"><i></i>
+              </label>
+            </div>
+            <div class="form-group">
+              <label for="username" class="col-lg-1 text-left col-sm-2 control-label">
+                User
+                <portainer-tooltip position="bottom" message="Format is one of: user, user:group, uid or uid:gid"></portainer-tooltip>
+              </label>
+              <div class="col-lg-11 col-sm-10">
+                <input class="form-control" type="text" name="username" ng-model="formValues.user" placeholder="root">
              </div>
            </div>
-            <!-- !command-list -->
-            <div class="col-sm-8">
-              <button type="button" class="btn btn-primary" ng-click="connect()" ng-disabled="state.connected">Connect</button>
-              <button type="button" class="btn btn-default" ng-click="disconnect()" ng-disabled="!state.connected">Disconnect</button>
+            <div class="form-group">
+              <div class="col-lg-offset-1 col-sm-offset-2 col-lg-11 col-sm-10">
+                <button type="button" class="btn btn-primary" ng-click="connect()">Connect</button>
+              </div>
            </div>
          </div>
+          <div ng-if="state.connected">
+            <label>Exec into container as <code>{{ ::formValues.user || 'default user' }}</code> using command <code>{{ formValues.isCustomCommand ? formValues.customCommand : formValues.command }}</code></label>
+            <button type="button" class="btn btn-default" ng-click="disconnect()">Disconnect</button>
+          </div>
        </form>
      </rd-widget-body>
    </rd-widget>
@@ -1,9 +1,10 @@
 angular.module('containerConsole', [])
-.controller('ContainerConsoleController', ['$scope', '$stateParams', 'Settings', 'Container', 'Image', 'Exec', '$timeout', 'EndpointProvider', 'Messages',
-function ($scope, $stateParams, Settings, Container, Image, Exec, $timeout, EndpointProvider, Messages) {
+.controller('ContainerConsoleController', ['$scope', '$stateParams', 'Container', 'Image', 'EndpointProvider', 'Notifications', 'ContainerHelper', 'ContainerService', 'ExecService',
+function ($scope, $stateParams, Container, Image, EndpointProvider, Notifications, ContainerHelper, ContainerService, ExecService) {
  $scope.state = {};
  $scope.state.loaded = false;
  $scope.state.connected = false;
+  $scope.formValues = {};

  var socket, term;

@@ -17,55 +18,58 @@ function ($scope, $stateParams, Settings, Container, Image, Exec, $timeout, Endp
  Container.get({id: $stateParams.id}, function(d) {
    $scope.container = d;
    if (d.message) {
-      Messages.error("Error", d, 'Unable to retrieve container details');
+      Notifications.error('Error', d, 'Unable to retrieve container details');
      $('#loadingViewSpinner').hide();
    } else {
      Image.get({id: d.Image}, function(imgData) {
        $scope.imageOS = imgData.Os;
-        $scope.state.command = imgData.Os === 'windows' ? 'powershell' : 'bash';
+        $scope.formValues.command = imgData.Os === 'windows' ? 'powershell' : 'bash';
        $scope.state.loaded = true;
        $('#loadingViewSpinner').hide();
      }, function (e) {
-        Messages.error("Failure", e, 'Unable to retrieve image details');
+        Notifications.error('Failure', e, 'Unable to retrieve image details');
        $('#loadingViewSpinner').hide();
      });
    }
  }, function (e) {
-    Messages.error("Failure", e, 'Unable to retrieve container details');
+    Notifications.error('Failure', e, 'Unable to retrieve container details');
    $('#loadingViewSpinner').hide();
  });

  $scope.connect = function() {
    $('#loadConsoleSpinner').show();
-    var termWidth = Math.round($('#terminal-container').width() / 8.2);
+    var termWidth = Math.floor(($('#terminal-container').width() - 20) / 8.39);
    var termHeight = 30;
+    var command = $scope.formValues.isCustomCommand ?
+                    $scope.formValues.customCommand : $scope.formValues.command;
    var execConfig = {
      id: $stateParams.id,
      AttachStdin: true,
      AttachStdout: true,
      AttachStderr: true,
      Tty: true,
-      Cmd: $scope.state.command.replace(" ", ",").split(",")
+      User: $scope.formValues.user,
+      Cmd: ContainerHelper.commandStringToArray(command)
    };

-    Container.exec(execConfig, function(d) {
-      if (d.message) {
-        $('#loadConsoleSpinner').hide();
-        Messages.error("Error", {}, d.message);
+    var execId;
+    ContainerService.createExec(execConfig)
+    .then(function success(data) {
+      execId = data.Id;
+      var url = window.location.href.split('#')[0] + 'api/websocket/exec?id=' + execId + '&endpointId=' + EndpointProvider.endpointID();
+      if (url.indexOf('https') > -1) {
+        url = url.replace('https://', 'wss://');
      } else {
-        var execId = d.Id;
-        resizeTTY(execId, termHeight, termWidth);
-        var url = window.location.href.split('#')[0] + 'api/websocket/exec?id=' + execId + '&endpointId=' + EndpointProvider.endpointID();
-        if (url.indexOf('https') > -1) {
-          url = url.replace('https://', 'wss://');
-        } else {
-          url = url.replace('http://', 'ws://');
-        }
-        initTerm(url, termHeight, termWidth);
+        url = url.replace('http://', 'ws://');
      }
-    }, function (e) {
+      initTerm(url, termHeight, termWidth);
+      return ExecService.resizeTTY(execId, termHeight, termWidth, 2000);
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to exec into container');
+    })
+    .finally(function final() {
      $('#loadConsoleSpinner').hide();
-      Messages.error("Failure", e, 'Unable to start an exec instance');
    });
  };

@@ -79,19 +83,6 @@ function ($scope, $stateParams, Settings, Container, Image, Exec, $timeout, Endp
    }
  };

-  function resizeTTY(execId, height, width) {
-    $timeout(function() {
-      Exec.resize({id: execId, height: height, width: width}, function (d) {
-        if (d.message) {
-          Messages.error('Error', {}, 'Unable to resize TTY');
-        }
-      }, function (e) {
-        Messages.error("Failure", {}, 'Unable to resize TTY');
-      });
-    }, 2000);
-
-  }
-
  function initTerm(url, height, width) {
    socket = new WebSocket(url);

@@ -103,9 +94,14 @@ function ($scope, $stateParams, Settings, Container, Image, Exec, $timeout, Endp
      term.on('data', function (data) {
        socket.send(data);
      });
-      term.open(document.getElementById('terminal-container'));
+      term.open(document.getElementById('terminal-container'), true);
      term.resize(width, height);
      term.setOption('cursorBlink', true);
+      term.fit();
+
+      window.onresize = function() {
+        term.fit();
+      };

      socket.onmessage = function (e) {
        term.write(e.data);
@@ -14,7 +14,7 @@ function ($scope, $stateParams, $anchorScroll, ContainerLogs, Container) {
    $('#loadingViewSpinner').hide();
  }, function (e) {
    $('#loadingViewSpinner').hide();
-    Messages.error("Failure", e, "Unable to retrieve container info");
+    Notifications.error('Failure', e, 'Unable to retrieve container info');
  });

  function getLogs() {
@@ -60,7 +60,7 @@ function ($scope, $stateParams, $anchorScroll, ContainerLogs, Container) {
  getLogs();
  var logIntervalId = window.setInterval(getLogs, 5000);

-  $scope.$on("$destroy", function () {
+  $scope.$on('$destroy', function () {
    // clearing interval when view changes
    clearInterval(logIntervalId);
  });
@@ -3,7 +3,7 @@
      <i id="loadingViewSpinner" class="fa fa-cog fa-spin"></i>
  </rd-header-title>
  <rd-header-content>
-    <a ui-sref="containers">Containers</a> > <a ui-sref="container({id: container.Id})">{{ container.Name|trimcontainername }}</a> > Logs
+    <a ui-sref="containers">Containers</a> &gt; <a ui-sref="container({id: container.Id})">{{ container.Name|trimcontainername }}</a> &gt; Logs
  </rd-header-content>
 </rd-header>

@@ -0,0 +1,123 @@
+<rd-header>
+  <rd-header-title title="Container statistics">
+    <i id="loadingViewSpinner" class="fa fa-cog fa-spin"></i>
+  </rd-header-title>
+  <rd-header-content>
+    <a ui-sref="containers">Containers</a> &gt; <a ui-sref="container({id: container.Id})">{{ container.Name|trimcontainername }}</a> &gt; Stats
+  </rd-header-content>
+</rd-header>
+
+<div class="row">
+  <div class="col-md-12">
+    <rd-widget>
+      <rd-widget-header icon="fa-info-circle" title="About statistics">
+      </rd-widget-header>
+      <rd-widget-body>
+        <form class="form-horizontal">
+          <div class="form-group">
+            <div class="col-sm-12">
+              <span class="small text-muted">
+                This view displays real-time statistics about the container <b>{{ container.Name|trimcontainername }}</b> as well as a list of the running processes
+                inside this container.
+              </span>
+            </div>
+          </div>
+          <div class="form-group">
+            <label for="refreshRate" class="col-sm-3 col-md-2 col-lg-2 margin-sm-top control-label text-left">
+              Refresh rate
+            </label>
+            <div class="col-sm-3 col-md-2">
+              <select id="refreshRate" ng-model="state.refreshRate" ng-change="changeUpdateRepeater()" class="form-control">
+                <option value="5">5s</option>
+                <option value="10">10s</option>
+                <option value="30">30s</option>
+                <option value="60">60s</option>
+              </select>
+            </div>
+            <span>
+              <i id="refreshRateChange" class="fa fa-check green-icon" aria-hidden="true" style="margin-top: 7px; display: none;"></i>
+            </span>
+          </div>
+        </form>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
+
+<div class="row">
+  <div class="col-lg-4 col-md-6 col-sm-12">
+    <rd-widget>
+      <rd-widget-header icon="fa-area-chart" title="Memory usage"></rd-widget-header>
+      <rd-widget-body>
+        <div class="chart-container" style="position: relative;">
+          <canvas id="memoryChart" width="770" height="300"></canvas>
+        </div>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+  <div class="col-lg-4 col-md-6 col-sm-12">
+    <rd-widget>
+      <rd-widget-header icon="fa-area-chart" title="CPU usage"></rd-widget-header>
+      <rd-widget-body>
+        <div class="chart-container" style="position: relative;">
+          <canvas id="cpuChart" width="770" height="300"></canvas>
+        </div>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+  <div class="col-lg-4 col-md-12 col-sm-12">
+    <rd-widget>
+      <rd-widget-header icon="fa-area-chart" title="Network usage"></rd-widget-header>
+      <rd-widget-body>
+        <div class="chart-container" style="position: relative;">
+          <canvas id="networkChart" width="770" height="300"></canvas>
+        </div>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+  <div class="col-sm-12" ng-if="applicationState.endpoint.mode.provider !== 'VMWARE_VIC'">
+    <rd-widget>
+      <rd-widget-header icon="fa-tasks" title="Processes">
+        <div class="pull-right">
+          Items per page:
+          <select ng-model="state.pagination_count" ng-change="changePaginationCount()">
+            <option value="0">All</option>
+            <option value="10">10</option>
+            <option value="25">25</option>
+            <option value="50">50</option>
+            <option value="100">100</option>
+          </select>
+        </div>
+      </rd-widget-header>
+      <rd-widget-body classes="no-padding">
+        <table class="table table-striped">
+          <thead>
+            <tr>
+              <th ng-repeat="title in processInfo.Titles">
+                <a ng-click="order(title)">
+                  {{ title }}
+                  <span ng-show="sortType == title && !sortReverse" class="glyphicon glyphicon-chevron-down"></span>
+                  <span ng-show="sortType == title && sortReverse" class="glyphicon glyphicon-chevron-up"></span>
+                </a>
+              </th>
+            </tr>
+          </thead>
+          <tbody>
+            <tr dir-paginate="processDetails in state.filteredProcesses = (processInfo.Processes | orderBy:sortType:sortReverse |  itemsPerPage: state.pagination_count)">
+              <td ng-repeat="procInfo in processDetails track by $index">{{ procInfo }}</td>
+            </tr>
+            <tr ng-if="!processInfo.Processes">
+              <td colspan="processInfo.Titles.length" class="text-center text-muted">Loading...</td>
+            </tr>
+            <tr ng-if="state.filteredProcesses.length === 0">
+              <td colspan="processInfo.Titles.length" class="text-center text-muted">No processes available.</td>
+            </tr>
+          </tbody>
+        </table>
+        <div ng-if="processInfo.Processes" class="pagination-controls">
+          <dir-pagination-controls></dir-pagination-controls>
+        </div>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
@@ -0,0 +1,159 @@
+angular.module('containerStats', [])
+.controller('ContainerStatsController', ['$q', '$scope', '$stateParams', '$document', '$interval', 'ContainerService', 'ChartService', 'Notifications', 'Pagination',
+function ($q, $scope, $stateParams, $document, $interval, ContainerService, ChartService, Notifications, Pagination) {
+
+  $scope.state = {
+    refreshRate: '5'
+  };
+
+  $scope.state.pagination_count = Pagination.getPaginationCount('stats_processes');
+  $scope.sortType = 'CMD';
+  $scope.sortReverse = false;
+
+  $scope.order = function (sortType) {
+    $scope.sortReverse = ($scope.sortType === sortType) ? !$scope.sortReverse : false;
+    $scope.sortType = sortType;
+  };
+
+  $scope.changePaginationCount = function() {
+    Pagination.setPaginationCount('stats_processes', $scope.state.pagination_count);
+  };
+
+  $scope.$on('$destroy', function() {
+    stopRepeater();
+  });
+
+  function stopRepeater() {
+    var repeater = $scope.repeater;
+    if (angular.isDefined(repeater)) {
+      $interval.cancel(repeater);
+      repeater = null;
+    }
+  }
+
+  function updateNetworkChart(stats, chart) {
+    var rx = stats.Networks[0].rx_bytes;
+    var tx = stats.Networks[0].tx_bytes;
+    var label = moment(stats.Date).format('HH:mm:ss');
+
+    ChartService.UpdateNetworkChart(label, rx, tx, chart);
+  }
+
+  function updateMemoryChart(stats, chart) {
+    var label = moment(stats.Date).format('HH:mm:ss');
+    var value = stats.MemoryUsage;
+
+    ChartService.UpdateMemoryChart(label, value, chart);
+  }
+
+  function updateCPUChart(stats, chart) {
+    var label = moment(stats.Date).format('HH:mm:ss');
+    var value = calculateCPUPercentUnix(stats);
+
+    ChartService.UpdateCPUChart(label, value, chart);
+  }
+
+  function calculateCPUPercentUnix(stats) {
+    var cpuPercent = 0.0;
+    var cpuDelta = stats.CurrentCPUTotalUsage - stats.PreviousCPUTotalUsage;
+    var systemDelta = stats.CurrentCPUSystemUsage - stats.PreviousCPUSystemUsage;
+
+    if (systemDelta > 0.0 && cpuDelta > 0.0) {
+      cpuPercent = (cpuDelta / systemDelta) * stats.CPUCores * 100.0;
+    }
+
+    return cpuPercent;
+  }
+
+  $scope.changeUpdateRepeater = function() {
+    var networkChart = $scope.networkChart;
+    var cpuChart = $scope.cpuChart;
+    var memoryChart = $scope.memoryChart;
+
+    stopRepeater();
+    setUpdateRepeater(networkChart, cpuChart, memoryChart);
+    $('#refreshRateChange').show();
+    $('#refreshRateChange').fadeOut(1500);
+  };
+
+  function startChartUpdate(networkChart, cpuChart, memoryChart) {
+    $('#loadingViewSpinner').show();
+    $q.all({
+      stats: ContainerService.containerStats($stateParams.id),
+      top: ContainerService.containerTop($stateParams.id)
+    })
+    .then(function success(data) {
+      var stats = data.stats;
+      $scope.processInfo = data.top;
+      updateNetworkChart(stats, networkChart);
+      updateMemoryChart(stats, memoryChart);
+      updateCPUChart(stats, cpuChart);
+      setUpdateRepeater(networkChart, cpuChart, memoryChart);
+    })
+    .catch(function error(err) {
+      stopRepeater();
+      Notifications.error('Failure', err, 'Unable to retrieve container statistics');
+    })
+    .finally(function final() {
+      $('#loadingViewSpinner').hide();
+    });
+  }
+
+  function setUpdateRepeater(networkChart, cpuChart, memoryChart) {
+    var refreshRate = $scope.state.refreshRate;
+    $scope.repeater = $interval(function() {
+      $q.all({
+        stats: ContainerService.containerStats($stateParams.id),
+        top: ContainerService.containerTop($stateParams.id)
+      })
+      .then(function success(data) {
+        var stats = data.stats;
+        $scope.processInfo = data.top;
+        updateNetworkChart(stats, networkChart);
+        updateMemoryChart(stats, memoryChart);
+        updateCPUChart(stats, cpuChart);
+      })
+      .catch(function error(err) {
+        stopRepeater();
+        Notifications.error('Failure', err, 'Unable to retrieve container statistics');
+      });
+    }, refreshRate * 1000);
+  }
+
+  function initCharts() {
+    var networkChartCtx = $('#networkChart');
+    var networkChart = ChartService.CreateNetworkChart(networkChartCtx);
+    $scope.networkChart = networkChart;
+
+    var cpuChartCtx = $('#cpuChart');
+    var cpuChart = ChartService.CreateCPUChart(cpuChartCtx);
+    $scope.cpuChart = cpuChart;
+
+    var memoryChartCtx = $('#memoryChart');
+    var memoryChart = ChartService.CreateMemoryChart(memoryChartCtx);
+    $scope.memoryChart = memoryChart;
+
+    startChartUpdate(networkChart, cpuChart, memoryChart);
+  }
+
+  function initView() {
+    $('#loadingViewSpinner').show();
+
+    ContainerService.container($stateParams.id)
+    .then(function success(data) {
+      $scope.container = data;
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to retrieve container information');
+    })
+    .finally(function final() {
+      $('#loadingViewSpinner').hide();
+    });
+
+    $document.ready(function() {
+      initCharts();
+    });
+  }
+
+  initView();
+}]);
@@ -25,13 +25,13 @@
    <rd-widget-taskbar classes="col-lg-12">
      <div class="pull-left">
        <div class="btn-group" role="group" aria-label="...">
-          <button type="button" class="btn btn-success btn-responsive" ng-click="startAction()" ng-disabled="!state.selectedItemCount"><i class="fa fa-play space-right" aria-hidden="true"></i>Start</button>
-          <button type="button" class="btn btn-danger btn-responsive" ng-click="stopAction()" ng-disabled="!state.selectedItemCount"><i class="fa fa-stop space-right" aria-hidden="true"></i>Stop</button>
+          <button type="button" class="btn btn-success btn-responsive" ng-click="startAction()" ng-disabled="!state.selectedItemCount || state.noStoppedItemsSelected"><i class="fa fa-play space-right" aria-hidden="true"></i>Start</button>
+          <button type="button" class="btn btn-danger btn-responsive" ng-click="stopAction()" ng-disabled="!state.selectedItemCount || state.noRunningItemsSelected"><i class="fa fa-stop space-right" aria-hidden="true"></i>Stop</button>
          <button type="button" class="btn btn-danger btn-responsive" ng-click="killAction()" ng-disabled="!state.selectedItemCount"><i class="fa fa-bomb space-right" aria-hidden="true"></i>Kill</button>
          <button type="button" class="btn btn-primary btn-responsive" ng-click="restartAction()" ng-disabled="!state.selectedItemCount"><i class="fa fa-refresh space-right" aria-hidden="true"></i>Restart</button>
-          <button type="button" class="btn btn-primary btn-responsive" ng-click="pauseAction()" ng-disabled="!state.selectedItemCount"><i class="fa fa-pause space-right" aria-hidden="true"></i>Pause</button>
-          <button type="button" class="btn btn-primary btn-responsive" ng-click="unpauseAction()" ng-disabled="!state.selectedItemCount"><i class="fa fa-play space-right" aria-hidden="true"></i>Resume</button>
-          <button type="button" class="btn btn-danger btn-responsive" ng-click="removeAction()" ng-disabled="!state.selectedItemCount"><i class="fa fa-trash space-right" aria-hidden="true"></i>Remove</button>
+          <button type="button" class="btn btn-primary btn-responsive" ng-click="pauseAction()" ng-disabled="!state.selectedItemCount || state.noRunningItemsSelected"><i class="fa fa-pause space-right" aria-hidden="true"></i>Pause</button>
+          <button type="button" class="btn btn-primary btn-responsive" ng-click="unpauseAction()" ng-disabled="!state.selectedItemCount || state.noPausedItemsSelected"><i class="fa fa-play space-right" aria-hidden="true"></i>Resume</button>
+          <button type="button" class="btn btn-danger btn-responsive" ng-click="confirmRemoveAction()" ng-disabled="!state.selectedItemCount"><i class="fa fa-trash space-right" aria-hidden="true"></i>Remove</button>
        </div>
        <a class="btn btn-primary" type="button" ui-sref="actions.create.container"><i class="fa fa-plus space-right" aria-hidden="true"></i>Add container</a>
      </div>
@@ -61,6 +61,9 @@
                  <span ng-show="sortType == 'Names' && !sortReverse" class="glyphicon glyphicon-chevron-down"></span>
                  <span ng-show="sortType == 'Names' && sortReverse" class="glyphicon glyphicon-chevron-up"></span>
                </a>
+				<a data-toggle="tooltip" title="More" ng-click="truncateMore();" ng-show="showMore">
+					<i class="fa fa-plus-square" aria-hidden="true"></i>
+				</a>
              </th>
              <th>
                <a ui-sref="containers" ng-click="order('Image')">
@@ -91,10 +94,10 @@
                </a>
              </th>
              <th ng-if="applicationState.application.authentication">
-                <a ui-sref="containers" ng-click="order('Metadata.ResourceControl.OwnerId')">
+                <a ui-sref="containers" ng-click="order('ResourceControl.Ownership')">
                  Ownership
-                  <span ng-show="sortType == 'Metadata.ResourceControl.OwnerId' && !sortReverse" class="glyphicon glyphicon-chevron-down"></span>
-                  <span ng-show="sortType == 'Metadata.ResourceControl.OwnerId' && sortReverse" class="glyphicon glyphicon-chevron-up"></span>
+                  <span ng-show="sortType == 'ResourceControl.Ownership' && !sortReverse" class="glyphicon glyphicon-chevron-down"></span>
+                  <span ng-show="sortType == 'ResourceControl.Ownership' && sortReverse" class="glyphicon glyphicon-chevron-up"></span>
                </a>
              </th>
            </tr>
@@ -102,47 +105,25 @@
          <tbody>
            <tr dir-paginate="container in (state.filteredContainers = ( containers | filter:state.filter | orderBy:sortType:sortReverse | itemsPerPage: state.pagination_count))">
              <td><input type="checkbox" ng-model="container.Checked" ng-change="selectItem(container)"/></td>
-              <td><span class="label label-{{ container.Status|containerstatusbadge }}">{{ container.Status }}</span></td>
-              <td ng-if="applicationState.endpoint.mode.provider === 'DOCKER_SWARM'"><a ui-sref="container({id: container.Id})">{{ container|swarmcontainername|truncate: 40}}</a></td>
-              <td ng-if="applicationState.endpoint.mode.provider !== 'DOCKER_SWARM'"><a ui-sref="container({id: container.Id})">{{ container|containername|truncate: 40}}</a></td>
+              <td>
+                <span ng-if="['starting','healthy','unhealthy'].indexOf(container.Status) !== -1" class="label label-{{ container.Status|containerstatusbadge }} interactive" uib-tooltip="This container has a health check">{{ container.Status }}</span>
+                <span ng-if="['starting','healthy','unhealthy'].indexOf(container.Status) === -1" class="label label-{{ container.Status|containerstatusbadge }}">{{ container.Status }}</span>
+              </td>
+              <td ng-if="applicationState.endpoint.mode.provider === 'DOCKER_SWARM'"><a ui-sref="container({id: container.Id})">{{ container|swarmcontainername|truncate: truncate_size}}</a></td>
+              <td ng-if="applicationState.endpoint.mode.provider !== 'DOCKER_SWARM'"><a ui-sref="container({id: container.Id})">{{ container|containername|truncate: truncate_size}}</a></td>
              <td><a ui-sref="image({id: container.Image})">{{ container.Image | hideshasum }}</a></td>
              <td ng-if="state.displayIP">{{ container.IP ? container.IP : '-' }}</td>
              <td ng-if="applicationState.endpoint.mode.provider === 'DOCKER_SWARM'">{{ container.hostIP }}</td>
              <td>
-                <a ng-if="container.Ports.length > 0" ng-repeat="p in container.Ports" class="image-tag" ng-href="http://{{p.host}}:{{p.public}}" target="_blank">
+                <a ng-if="container.Ports.length > 0" ng-repeat="p in container.Ports" class="image-tag" ng-href="http://{{ PublicURL || p.host }}:{{p.public}}" target="_blank">
                  <i class="fa fa-external-link" aria-hidden="true"></i> {{p.public}}:{{ p.private }}
                </a>
                <span ng-if="container.Ports.length == 0" >-</span>
              </td>
              <td ng-if="applicationState.application.authentication">
-                <span ng-if="!container.Metadata.ResourceControl">
-                  <i class="fa fa-eye" aria-hidden="true"></i>
-                  <span ng-if="container.Labels['com.docker.swarm.service.id']">
-                    Public service
-                  </span>
-                  <span ng-if="!container.Labels['com.docker.swarm.service.id']">
-                    Public
-                  </span>
-                </span>
-                <span ng-if="container.Metadata.ResourceControl.OwnerId === user.ID">
-                  <i class="fa fa-eye-slash" aria-hidden="true"></i>
-                  <span ng-if="container.Labels['com.docker.swarm.service.id']">
-                    Private service
-                  </span>
-                  <span ng-if="!container.Labels['com.docker.swarm.service.id']">
-                    Private
-                    <a ng-click="switchOwnership(container)" class="interactive"><i class="fa fa-eye" aria-hidden="true" style="margin-left: 7px;"></i> Switch to public</a>
-                  </span>
-                </span>
-                <span ng-if="container.Metadata.ResourceControl && container.Metadata.ResourceControl.OwnerId !== user.ID">
-                  <i class="fa fa-eye-slash" aria-hidden="true"></i>
-                  <span ng-if="container.Labels['com.docker.swarm.service.id']">
-                    Private service <span ng-if="container.Owner">(owner: {{ container.Owner }})</span>
-                  </span>
-                  <span ng-if="!container.Labels['com.docker.swarm.service.id']">
-                    Private <span ng-if="container.Owner">(owner: {{ container.Owner }})</span>
-                    <a ng-click="switchOwnership(container)" class="interactive"><i class="fa fa-eye" aria-hidden="true" style="margin-left: 7px;"></i> Switch to public</a>
-                  </span>
+                <span>
+                  <i ng-class="container.ResourceControl.Ownership | ownershipicon" aria-hidden="true"></i>
+                  {{ container.ResourceControl.Ownership ? container.ResourceControl.Ownership : container.ResourceControl.Ownership = 'public' }}
                </span>
              </td>
            </tr>
@@ -159,5 +140,5 @@
        </div>
      </div>
    </rd-widget-body>
-  <rd-widget>
+  </rd-widget>
 </div>
@@ -1,73 +1,33 @@
 angular.module('containers', [])
-  .controller('ContainersController', ['$q', '$scope', '$filter', 'Container', 'ContainerHelper', 'Info', 'Settings', 'Messages', 'Config', 'Pagination', 'EntityListService', 'ModalService', 'Authentication', 'ResourceControlService', 'UserService',
-  function ($q, $scope, $filter, Container, ContainerHelper, Info, Settings, Messages, Config, Pagination, EntityListService, ModalService, Authentication, ResourceControlService, UserService) {
+  .controller('ContainersController', ['$q', '$scope', '$filter', 'Container', 'ContainerService', 'ContainerHelper', 'SystemService', 'Notifications', 'Pagination', 'EntityListService', 'ModalService', 'ResourceControlService', 'EndpointProvider', 'LocalStorage',
+  function ($q, $scope, $filter, Container, ContainerService, ContainerHelper, SystemService, Notifications, Pagination, EntityListService, ModalService, ResourceControlService, EndpointProvider, LocalStorage) {
  $scope.state = {};
  $scope.state.pagination_count = Pagination.getPaginationCount('containers');
-  $scope.state.displayAll = Settings.displayAll;
+  $scope.state.displayAll = LocalStorage.getFilterContainerShowAll();
  $scope.state.displayIP = false;
  $scope.sortType = 'State';
  $scope.sortReverse = false;
  $scope.state.selectedItemCount = 0;
+  $scope.truncate_size = 40;
+  $scope.showMore = true;
+
  $scope.order = function (sortType) {
    $scope.sortReverse = ($scope.sortType === sortType) ? !$scope.sortReverse : false;
    $scope.sortType = sortType;
  };
+  $scope.PublicURL = EndpointProvider.endpointPublicURL();

  $scope.changePaginationCount = function() {
    Pagination.setPaginationCount('containers', $scope.state.pagination_count);
  };

-  function removeContainerResourceControl(container) {
-    volumeResourceControlQueries = [];
-    angular.forEach(container.Mounts, function (volume) {
-      volumeResourceControlQueries.push(ResourceControlService.removeVolumeResourceControl(container.Metadata.ResourceControl.OwnerId, volume.Name));
-    });
-
-    $q.all(volumeResourceControlQueries)
-    .then(function success() {
-      return ResourceControlService.removeContainerResourceControl(container.Metadata.ResourceControl.OwnerId, container.Id);
-    })
-    .then(function success() {
-      delete container.Metadata.ResourceControl;
-      Messages.send('Ownership changed to public', container.Id);
-    })
-    .catch(function error(err) {
-      Messages.error("Failure", err, "Unable to change container ownership");
-    });
-  }
-
-  $scope.switchOwnership = function(container) {
-    ModalService.confirmContainerOwnershipChange(function (confirmed) {
-      if(!confirmed) { return; }
-      removeContainerResourceControl(container);
-    });
-  };
-
-  function mapUsersToContainers(users) {
-    angular.forEach($scope.containers, function (container) {
-      if (container.Metadata) {
-        var containerRC = container.Metadata.ResourceControl;
-        if (containerRC && containerRC.OwnerId !== $scope.user.ID) {
-          angular.forEach(users, function (user) {
-            if (containerRC.OwnerId === user.Id) {
-              container.Owner = user.Username;
-            }
-          });
-        }
-      }
-    });
-  }
+  $scope.cleanAssociatedVolumes = false;

  var update = function (data) {
    $('#loadContainersSpinner').show();
-    var userDetails = Authentication.getUserDetails();
-    $scope.user = userDetails;
    $scope.state.selectedItemCount = 0;
    Container.query(data, function (d) {
      var containers = d;
-      if ($scope.containersToHideLabels) {
-        containers = ContainerHelper.hideContainers(d, $scope.containersToHideLabels);
-      }
      $scope.containers = containers.map(function (container) {
        var model = new ContainerViewModel(container);
        model.Status = $filter('containerstatus')(model.Status);
@@ -84,23 +44,11 @@ angular.module('containers', [])
        }
        return model;
      });
-      if (userDetails.role === 1) {
-        UserService.users()
-        .then(function success(data) {
-          mapUsersToContainers(data);
-        })
-        .catch(function error(err) {
-          Messages.error("Failure", err, "Unable to retrieve users");
-        })
-        .finally(function final() {
-          $('#loadContainersSpinner').hide();
-        });
-      } else {
-        $('#loadContainersSpinner').hide();
-      }
+      updateSelectionFlags();
+      $('#loadContainersSpinner').hide();
    }, function (e) {
      $('#loadContainersSpinner').hide();
-      Messages.error("Failure", e, "Unable to retrieve containers");
+      Notifications.error('Failure', e, 'Unable to retrieve containers');
      $scope.containers = [];
    });
  };
@@ -112,7 +60,7 @@ angular.module('containers', [])
      counter = counter - 1;
      if (counter === 0) {
        $('#loadContainersSpinner').hide();
-        update({all: Settings.displayAll ? 1 : 0});
+        update({all: $scope.state.displayAll ? 1 : 0});
      }
    };
    angular.forEach(items, function (c) {
@@ -120,56 +68,44 @@ angular.module('containers', [])
        counter = counter + 1;
        if (action === Container.start) {
          action({id: c.Id}, {}, function (d) {
-            Messages.send("Container " + msg, c.Id);
+            Notifications.success('Container ' + msg, c.Id);
            complete();
          }, function (e) {
-            Messages.error("Failure", e, "Unable to start container");
+            Notifications.error('Failure', e, 'Unable to start container');
            complete();
          });
        }
        else if (action === Container.remove) {
-          action({id: c.Id}, function (d) {
-            if (d.message) {
-              Messages.send("Error", d.message);
-            }
-            else {
-              if (c.Metadata && c.Metadata.ResourceControl) {
-                ResourceControlService.removeContainerResourceControl(c.Metadata.ResourceControl.OwnerId, c.Id)
-                .then(function success() {
-                  Messages.send("Container " + msg, c.Id);
-                })
-                .catch(function error(err) {
-                  Messages.error("Failure", err, "Unable to remove container ownership");
-                });
-              } else {
-                Messages.send("Container " + msg, c.Id);
-              }
-            }
-            complete();
-          }, function (e) {
-            Messages.error("Failure", e, 'Unable to remove container');
+          ContainerService.remove(c, $scope.cleanAssociatedVolumes)
+          .then(function success() {
+            Notifications.success('Container successfully removed');
+          })
+          .catch(function error(err) {
+            Notifications.error('Failure', err, 'Unable to remove container');
+          })
+          .finally(function final() {
            complete();
          });
        }
        else if (action === Container.pause) {
          action({id: c.Id}, function (d) {
            if (d.message) {
-              Messages.send("Container is already paused", c.Id);
+              Notifications.success('Container is already paused', c.Id);
            } else {
-              Messages.send("Container " + msg, c.Id);
+              Notifications.success('Container ' + msg, c.Id);
            }
            complete();
          }, function (e) {
-            Messages.error("Failure", e, 'Unable to pause container');
+            Notifications.error('Failure', e, 'Unable to pause container');
            complete();
          });
        }
        else {
          action({id: c.Id}, function (d) {
-            Messages.send("Container " + msg, c.Id);
+            Notifications.success('Container ' + msg, c.Id);
            complete();
          }, function (e) {
-            Messages.error("Failure", e, 'An error occured');
+            Notifications.error('Failure', e, 'An error occured');
            complete();
          });

@@ -185,51 +121,108 @@ angular.module('containers', [])
    angular.forEach($scope.state.filteredContainers, function (container) {
      if (container.Checked !== allSelected) {
        container.Checked = allSelected;
-        $scope.selectItem(container);
+        toggleItemSelection(container);
      }
    });
+    updateSelectionFlags();
  };

  $scope.selectItem = function (item) {
+    toggleItemSelection(item);
+    updateSelectionFlags();
+  };
+
+  $scope.toggleGetAll = function () {
+    LocalStorage.storeFilterContainerShowAll($scope.state.displayAll);
+    update({all: $scope.state.displayAll ? 1 : 0});
+  };
+
+  $scope.startAction = function () {
+    batch($scope.containers, Container.start, 'Started');
+  };
+
+  $scope.stopAction = function () {
+    batch($scope.containers, Container.stop, 'Stopped');
+  };
+
+  $scope.restartAction = function () {
+    batch($scope.containers, Container.restart, 'Restarted');
+  };
+
+  $scope.killAction = function () {
+    batch($scope.containers, Container.kill, 'Killed');
+  };
+
+  $scope.pauseAction = function () {
+    batch($scope.containers, Container.pause, 'Paused');
+  };
+
+  $scope.unpauseAction = function () {
+    batch($scope.containers, Container.unpause, 'Unpaused');
+  };
+
+  $scope.removeAction = function () {
+    batch($scope.containers, Container.remove, 'Removed');
+  };
+
+
+  $scope.truncateMore = function(size) {
+    $scope.truncate_size = 80;
+    $scope.showMore = false;
+  };
+
+  $scope.confirmRemoveAction = function () {
+    var isOneContainerRunning = false;
+    angular.forEach($scope.containers, function (c) {
+      if (c.Checked && c.State === 'running') {
+        isOneContainerRunning = true;
+        return;
+      }
+    });
+    var title = 'You are about to remove one or more container.';
+    if (isOneContainerRunning) {
+      title = 'You are about to remove one or more running containers.';
+    }
+    ModalService.confirmContainerDeletion(
+      title,
+      function (result) {
+        if(!result) { return; }
+        $scope.cleanAssociatedVolumes = false;
+        if (result[0]) {
+          $scope.cleanAssociatedVolumes = true;
+        }
+        $scope.removeAction();
+      }
+    );
+  };
+
+  function toggleItemSelection(item) {
    if (item.Checked) {
      $scope.state.selectedItemCount++;
    } else {
      $scope.state.selectedItemCount--;
    }
-  };
+  }

-  $scope.toggleGetAll = function () {
-    Settings.displayAll = $scope.state.displayAll;
-    update({all: Settings.displayAll ? 1 : 0});
-  };
+  function updateSelectionFlags() {
+    $scope.state.noStoppedItemsSelected = true;
+    $scope.state.noRunningItemsSelected = true;
+    $scope.state.noPausedItemsSelected = true;
+    $scope.containers.forEach(function(container) {
+      if(!container.Checked) {
+        return;
+      }

-  $scope.startAction = function () {
-    batch($scope.containers, Container.start, "Started");
-  };
-
-  $scope.stopAction = function () {
-    batch($scope.containers, Container.stop, "Stopped");
-  };
-
-  $scope.restartAction = function () {
-    batch($scope.containers, Container.restart, "Restarted");
-  };
-
-  $scope.killAction = function () {
-    batch($scope.containers, Container.kill, "Killed");
-  };
-
-  $scope.pauseAction = function () {
-    batch($scope.containers, Container.pause, "Paused");
-  };
-
-  $scope.unpauseAction = function () {
-    batch($scope.containers, Container.unpause, "Unpaused");
-  };
-
-  $scope.removeAction = function () {
-    batch($scope.containers, Container.remove, "Removed");
-  };
+      if(container.Status === 'paused') {
+        $scope.state.noPausedItemsSelected = false;
+      } else if(container.Status === 'stopped' ||
+                container.Status === 'created') {
+        $scope.state.noStoppedItemsSelected = false;
+      } else if(container.Status === 'running') {
+        $scope.state.noRunningItemsSelected = false;
+      }
+    } );
+  }

  function retrieveSwarmHostsInfo(data) {
    var swarm_hosts = {};
@@ -246,15 +239,19 @@ angular.module('containers', [])
    return swarm_hosts;
  }

-  Config.$promise.then(function (c) {
-    $scope.containersToHideLabels = c.hiddenLabels;
-    if ($scope.applicationState.endpoint.mode.provider === 'DOCKER_SWARM') {
-      Info.get({}, function (d) {
-        $scope.swarm_hosts = retrieveSwarmHostsInfo(d);
-        update({all: Settings.displayAll ? 1 : 0});
-      });
-    } else {
-      update({all: Settings.displayAll ? 1 : 0});
-    }
-  });
+  function initView() {
+    var provider = $scope.applicationState.endpoint.mode.provider;
+    $q.when(provider !== 'DOCKER_SWARM' || SystemService.info())
+    .then(function success(data) {
+      if (provider === 'DOCKER_SWARM') {
+        $scope.swarm_hosts = retrieveSwarmHostsInfo(data);
+      }
+      update({all: $scope.state.displayAll ? 1 : 0});
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to retrieve cluster information');
+    });
+  }
+
+  initView();
 }]);
@@ -1,21 +1,24 @@
 // @@OLD_SERVICE_CONTROLLER: this service should be rewritten to use services.
 // See app/components/templates/templatesController.js as a reference.
 angular.module('createContainer', [])
-.controller('CreateContainerController', ['$scope', '$state', '$stateParams', '$filter', 'Config', 'Info', 'Container', 'ContainerHelper', 'Image', 'ImageHelper', 'Volume', 'Network', 'ResourceControlService', 'Authentication', 'Messages',
-function ($scope, $state, $stateParams, $filter, Config, Info, Container, ContainerHelper, Image, ImageHelper, Volume, Network, ResourceControlService, Authentication, Messages) {
+.controller('CreateContainerController', ['$q', '$scope', '$state', '$stateParams', '$filter', 'Container', 'ContainerHelper', 'Image', 'ImageHelper', 'Volume', 'NetworkService', 'ResourceControlService', 'Authentication', 'Notifications', 'ContainerService', 'ImageService', 'FormValidator', 'ModalService', 'RegistryService',
+function ($q, $scope, $state, $stateParams, $filter, Container, ContainerHelper, Image, ImageHelper, Volume, NetworkService, ResourceControlService, Authentication, Notifications, ContainerService, ImageService, FormValidator, ModalService, RegistryService) {

  $scope.formValues = {
-    Ownership: $scope.applicationState.application.authentication ? 'private' : '',
    alwaysPull: true,
    Console: 'none',
    Volumes: [],
-    Registry: '',
    NetworkContainer: '',
    Labels: [],
-    ExtraHosts: []
+    ExtraHosts: [],
+    IPv4: '',
+    IPv6: '',
+    AccessControlData: new AccessControlFormData()
  };

-  $scope.imageConfig = {};
+  $scope.state = {
+    formValidationError: ''
+  };

  $scope.config = {
    Image: '',
@@ -31,7 +34,11 @@ function ($scope, $state, $stateParams, $filter, Config, Info, Container, Contai
      Binds: [],
      NetworkMode: 'bridge',
      Privileged: false,
-      ExtraHosts: []
+      ExtraHosts: [],
+      Devices:[]
+    },
+    NetworkingConfig: {
+      EndpointsConfig: {}
    },
    Labels: {}
  };
@@ -76,103 +83,20 @@ function ($scope, $state, $stateParams, $filter, Config, Info, Container, Contai
    $scope.formValues.ExtraHosts.splice(index, 1);
  };

+  $scope.addDevice = function() {
+    $scope.config.HostConfig.Devices.push({ pathOnHost: '', pathInContainer: '' });
+  };

-  Config.$promise.then(function (c) {
-    var containersToHideLabels = c.hiddenLabels;
+  $scope.removeDevice = function(index) {
+    $scope.config.HostConfig.Devices.splice(index, 1);
+  };

-    Volume.query({}, function (d) {
-      $scope.availableVolumes = d.Volumes;
-    }, function (e) {
-      Messages.error("Failure", e, "Unable to retrieve volumes");
-    });
-
-    Network.query({}, function (d) {
-      var networks = d;
-      if ($scope.applicationState.endpoint.mode.provider === 'DOCKER_SWARM' || $scope.applicationState.endpoint.mode.provider === 'DOCKER_SWARM_MODE') {
-        networks = d.filter(function (network) {
-          if (network.Scope === 'global') {
-            return network;
-          }
-        });
-        $scope.globalNetworkCount = networks.length;
-        networks.push({Name: "bridge"});
-        networks.push({Name: "host"});
-        networks.push({Name: "none"});
-      }
-      networks.push({Name: "container"});
-      $scope.availableNetworks = networks;
-      if (!_.find(networks, {'Name': 'bridge'})) {
-        $scope.config.HostConfig.NetworkMode = 'nat';
-      }
-    }, function (e) {
-      Messages.error("Failure", e, "Unable to retrieve networks");
-    });
-
-    Container.query({}, function (d) {
-      var containers = d;
-      if (containersToHideLabels) {
-        containers = ContainerHelper.hideContainers(d, containersToHideLabels);
-      }
-      $scope.runningContainers = containers;
-    }, function(e) {
-      Messages.error("Failure", e, "Unable to retrieve running containers");
-    });
-  });
-
-  function startContainer(containerID) {
-    Container.start({id: containerID}, {}, function (cd) {
-      if (cd.message) {
-        $('#createContainerSpinner').hide();
-        Messages.error('Error', {}, cd.message);
-      } else {
-        $('#createContainerSpinner').hide();
-        Messages.send('Container Started', containerID);
-        $state.go('containers', {}, {reload: true});
-      }
-    }, function (e) {
-      $('#createContainerSpinner').hide();
-      Messages.error("Failure", e, 'Unable to start container');
-    });
-  }
-
-  function createContainer(config) {
-    Container.create(config, function (d) {
-      if (d.message) {
-        $('#createContainerSpinner').hide();
-        Messages.error('Error', {}, d.message);
-      } else {
-        if ($scope.formValues.Ownership === 'private') {
-          ResourceControlService.setContainerResourceControl(Authentication.getUserDetails().ID, d.Id)
-          .then(function success() {
-            startContainer(d.Id);
-          })
-          .catch(function error(err) {
-            $('#createContainerSpinner').hide();
-            Messages.error("Failure", err, 'Unable to apply resource control on container');
-          });
-        } else {
-          startContainer(d.Id);
-        }
-      }
-    }, function (e) {
-      $('#createContainerSpinner').hide();
-      Messages.error("Failure", e, 'Unable to create container');
-    });
-  }
-
-  function pullImageAndCreateContainer(config) {
-    Image.create($scope.imageConfig, function (data) {
-      createContainer(config);
-    }, function (e) {
-      $('#createContainerSpinner').hide();
-      Messages.error('Failure', e, 'Unable to pull image');
-    });
-  }
+  $scope.fromContainerMultipleNetworks = false;

  function prepareImageConfig(config) {
    var image = config.Image;
    var registry = $scope.formValues.Registry;
-    var imageConfig = ImageHelper.createImageConfigForContainer(image, registry);
+    var imageConfig = ImageHelper.createImageConfigForContainer(image, registry.URL);
    config.Image = imageConfig.fromImage + ':' + imageConfig.tag;
    $scope.imageConfig = imageConfig;
  }
@@ -181,7 +105,7 @@ function ($scope, $state, $stateParams, $filter, Config, Info, Container, Contai
    var bindings = {};
    config.HostConfig.PortBindings.forEach(function (portBinding) {
      if (portBinding.containerPort) {
-        var key = portBinding.containerPort + "/" + portBinding.protocol;
+        var key = portBinding.containerPort + '/' + portBinding.protocol;
        var binding = {};
        if (portBinding.hostPort && portBinding.hostPort.indexOf(':') > -1) {
          var hostAndPort = portBinding.hostPort.split(':');
@@ -217,7 +141,7 @@ function ($scope, $state, $stateParams, $filter, Config, Info, Container, Contai
    var env = [];
    config.Env.forEach(function (v) {
      if (v.name && v.value) {
-        env.push(v.name + "=" + v.value);
+        env.push(v.name + '=' + v.value);
      }
    });
    config.Env = env;
@@ -256,9 +180,17 @@ function ($scope, $state, $stateParams, $filter, Config, Info, Container, Contai
    var networkMode = mode;
    if (containerName) {
      networkMode += ':' + containerName;
+      config.Hostname = '';
    }
    config.HostConfig.NetworkMode = networkMode;

+    config.NetworkingConfig.EndpointsConfig[networkMode] = {
+      IPAMConfig: {
+        IPv4Address: $scope.formValues.IPv4,
+        IPv6Address: $scope.formValues.IPv6
+      }
+    };
+
    $scope.formValues.ExtraHosts.forEach(function (v) {
    if (v.value) {
        config.HostConfig.ExtraHosts.push(v.value);
@@ -276,6 +208,19 @@ function ($scope, $state, $stateParams, $filter, Config, Info, Container, Contai
    config.Labels = labels;
  }

+  function prepareDevices(config) {
+    var path = [];
+    config.HostConfig.Devices.forEach(function (p) {
+      if (p.pathOnHost) {
+        if(p.pathInContainer === '') {
+          p.pathInContainer = p.pathOnHost;
+        }
+        path.push({PathOnHost:p.pathOnHost,PathInContainer:p.pathInContainer,CgroupPermissions:'rwm'});
+      }
+    });
+    config.HostConfig.Devices = path;
+  }
+
  function prepareConfiguration() {
    var config = angular.copy($scope.config);
    config.Cmd = ContainerHelper.commandStringToArray(config.Cmd);
@@ -286,16 +231,316 @@ function ($scope, $state, $stateParams, $filter, Config, Info, Container, Contai
    prepareEnvironmentVariables(config);
    prepareVolumes(config);
    prepareLabels(config);
+    prepareDevices(config);
    return config;
  }

-  $scope.create = function () {
-    var config = prepareConfiguration();
-    $('#createContainerSpinner').show();
-    if ($scope.formValues.alwaysPull) {
-      pullImageAndCreateContainer(config);
+  function confirmCreateContainer() {
+    var deferred = $q.defer();
+    Container.query({ all: 1, filters: {name: ['^/' + $scope.config.name + '$'] }}).$promise
+    .then(function success(data) {
+      var existingContainer = data[0];
+      if (existingContainer) {
+        ModalService.confirm({
+          title: 'Are you sure ?',
+          message: 'A container with the same name already exists. Portainer can automatically remove it and re-create one. Do you want to replace it?',
+          buttons: {
+            confirm: {
+              label: 'Replace',
+              className: 'btn-danger'
+            }
+          },
+          callback: function onConfirm(confirmed) {
+            if(!confirmed) { deferred.resolve(false); }
+            else {
+              // Remove old container
+              ContainerService.remove(existingContainer, true)
+              .then(function success(data) {
+                Notifications.success('Container Removed', existingContainer.Id);
+                deferred.resolve(true);
+              })
+              .catch(function error(err) {
+                deferred.reject({ msg: 'Unable to remove container', err: err });
+              });
+            }
+          }
+        });
+      } else {
+        deferred.resolve(true);
+      }
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to retrieve containers');
+      return undefined;
+    });
+    return deferred.promise;
+  }
+
+  function loadFromContainerCmd(d) {
+    if ($scope.config.Cmd) {
+      $scope.config.Cmd = ContainerHelper.commandArrayToString($scope.config.Cmd);
    } else {
-      createContainer(config);
+      $scope.config.Cmd = '';
    }
+  }
+
+  function loadFromContainerPortBindings(d) {
+    var bindings = [];
+    for (var p in $scope.config.HostConfig.PortBindings) {
+      if ({}.hasOwnProperty.call($scope.config.HostConfig.PortBindings, p)) {
+	var hostPort = '';
+        if ($scope.config.HostConfig.PortBindings[p][0].HostIp) {
+          hostPort = $scope.config.HostConfig.PortBindings[p][0].HostIp + ':';
+        }
+        hostPort += $scope.config.HostConfig.PortBindings[p][0].HostPort;
+        var b = {
+          'hostPort': hostPort,
+          'containerPort': p.split('/')[0],
+          'protocol': p.split('/')[1]
+        };
+        bindings.push(b);
+      }
+    }
+    $scope.config.HostConfig.PortBindings = bindings;
+  }
+
+  function loadFromContainerVolumes(d) {
+    for (var v in d.Mounts) {
+      if ({}.hasOwnProperty.call(d.Mounts, v)) {
+        var mount = d.Mounts[v];
+        var volume = {
+          'type': mount.Type,
+          'name': mount.Name || mount.Source,
+          'containerPath': mount.Destination,
+          'readOnly': mount.RW === false
+        };
+        $scope.formValues.Volumes.push(volume);
+      }
+    }
+  }
+
+  function loadFromContainerNetworkConfig(d) {
+    $scope.config.NetworkingConfig = {
+      EndpointsConfig: {}
+    };
+    var networkMode = d.HostConfig.NetworkMode;
+    if (networkMode === 'default') {
+      $scope.config.HostConfig.NetworkMode = 'bridge';
+      if (!_.find($scope.availableNetworks, {'Name': 'bridge'})) {
+        $scope.config.HostConfig.NetworkMode = 'nat';
+      }
+    }
+    if ($scope.config.HostConfig.NetworkMode.indexOf('container:') === 0) {
+      var netContainer = $scope.config.HostConfig.NetworkMode.split(/^container:/)[1];
+      $scope.config.HostConfig.NetworkMode = 'container';
+      for (var c in $scope.runningContainers) {
+        if ($scope.runningContainers[c].Names && $scope.runningContainers[c].Names[0] === '/' + netContainer) {
+          $scope.formValues.NetworkContainer = $scope.runningContainers[c];
+        }
+      }
+    }
+    $scope.fromContainerMultipleNetworks = Object.keys(d.NetworkSettings.Networks).length >= 2;
+    if (d.NetworkSettings.Networks[$scope.config.HostConfig.NetworkMode]) {
+      if (d.NetworkSettings.Networks[$scope.config.HostConfig.NetworkMode].IPAMConfig) {
+        if (d.NetworkSettings.Networks[$scope.config.HostConfig.NetworkMode].IPAMConfig.IPv4Address) {
+          $scope.formValues.IPv4 = d.NetworkSettings.Networks[$scope.config.HostConfig.NetworkMode].IPAMConfig.IPv4Address;
+        }
+        if (d.NetworkSettings.Networks[$scope.config.HostConfig.NetworkMode].IPAMConfig.IPv6Address) {
+          $scope.formValues.IPv6 = d.NetworkSettings.Networks[$scope.config.HostConfig.NetworkMode].IPAMConfig.IPv6Address;
+        }
+      }
+    }
+    $scope.config.NetworkingConfig.EndpointsConfig[$scope.config.HostConfig.NetworkMode] = d.NetworkSettings.Networks[$scope.config.HostConfig.NetworkMode];
+    // ExtraHosts
+    for (var h in $scope.config.HostConfig.ExtraHosts) {
+      if ({}.hasOwnProperty.call($scope.config.HostConfig.ExtraHosts, h)) {
+        $scope.formValues.ExtraHosts.push({'value': $scope.config.HostConfig.ExtraHosts[h]});
+        $scope.config.HostConfig.ExtraHosts = [];
+      }
+    }
+  }
+
+  function loadFromContainerEnvrionmentVariables(d) {
+    var envArr = [];
+    for (var e in $scope.config.Env) {
+      if ({}.hasOwnProperty.call($scope.config.Env, e)) {
+        var arr = $scope.config.Env[e].split(/\=(.+)/);
+        envArr.push({'name': arr[0], 'value': arr[1]});
+      }
+    }
+    $scope.config.Env = envArr;
+  }
+
+  function loadFromContainerLabels(d) {
+    for (var l in $scope.config.Labels) {
+      if ({}.hasOwnProperty.call($scope.config.Labels, l)) {
+        $scope.formValues.Labels.push({ name: l, value: $scope.config.Labels[l]});
+      }
+    }
+  }
+
+  function loadFromContainerConsole(d) {
+    if ($scope.config.OpenStdin && $scope.config.Tty) {
+      $scope.formValues.Console = 'both';
+    } else if (!$scope.config.OpenStdin && $scope.config.Tty) {
+      $scope.formValues.Console = 'tty';
+    } else if ($scope.config.OpenStdin && !$scope.config.Tty) {
+      $scope.formValues.Console = 'interactive';
+    } else if (!$scope.config.OpenStdin && !$scope.config.Tty) {
+      $scope.formValues.Console = 'none';
+    }
+  }
+
+  function loadFromContainerDevices(d) {
+    var path = [];
+    for (var dev in $scope.config.HostConfig.Devices) {
+      if ({}.hasOwnProperty.call($scope.config.HostConfig.Devices, dev)) {
+        var device = $scope.config.HostConfig.Devices[dev];
+        path.push({'pathOnHost': device.PathOnHost, 'pathInContainer': device.PathInContainer});
+      }
+    }
+    $scope.config.HostConfig.Devices = path;
+  }
+
+  function loadFromContainerImageConfig(d) {
+    var imageInfo = ImageHelper.extractImageAndRegistryFromRepository($scope.config.Image);
+    RegistryService.retrieveRegistryFromRepository($scope.config.Image)
+    .then(function success(data) {
+      if (data) {
+        $scope.config.Image = imageInfo.image;
+        $scope.formValues.Registry = data;
+      }
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to retrive registry');
+    });
+  }
+
+  function loadFromContainerSpec() {
+    // Get container
+    Container.get({ id: $stateParams.from }).$promise
+    .then(function success(d) {
+      var fromContainer = new ContainerDetailsViewModel(d);
+      if (!fromContainer.ResourceControl) {
+        $scope.formValues.AccessControlData.AccessControlEnabled = false;
+      }
+      $scope.fromContainer = fromContainer;
+      $scope.config = ContainerHelper.configFromContainer(fromContainer.Model);
+      loadFromContainerCmd(d);
+      loadFromContainerPortBindings(d);
+      loadFromContainerVolumes(d);
+      loadFromContainerNetworkConfig(d);
+      loadFromContainerEnvrionmentVariables(d);
+      loadFromContainerLabels(d);
+      loadFromContainerConsole(d);
+      loadFromContainerDevices(d);
+      loadFromContainerImageConfig(d);
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to retrieve container');
+    });
+  }
+
+  function initView() {
+    Volume.query({}, function (d) {
+      $scope.availableVolumes = d.Volumes;
+    }, function (e) {
+      Notifications.error('Failure', e, 'Unable to retrieve volumes');
+    });
+
+    var provider = $scope.applicationState.endpoint.mode.provider;
+    var apiVersion = $scope.applicationState.endpoint.apiVersion;
+    NetworkService.networks(
+      provider === 'DOCKER_STANDALONE' || provider === 'DOCKER_SWARM_MODE',
+      false,
+      provider === 'DOCKER_SWARM_MODE' && apiVersion >= 1.25,
+      provider === 'DOCKER_SWARM'
+    )
+    .then(function success(data) {
+      var networks = data;
+      networks.push({ Name: 'container' });
+      $scope.availableNetworks = networks;
+
+      if (_.find(networks, {'Name': 'nat'})) {
+        $scope.config.HostConfig.NetworkMode = 'nat';
+      }
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to retrieve networks');
+    });
+
+    Container.query({}, function (d) {
+      var containers = d;
+      $scope.runningContainers = containers;
+      if ($stateParams.from !== '') {
+        loadFromContainerSpec();
+      } else {
+        $scope.fromContainer = {};
+        $scope.formValues.Registry = {};
+      }
+    }, function(e) {
+      Notifications.error('Failure', e, 'Unable to retrieve running containers');
+    });
+
+  }
+
+  function validateForm(accessControlData, isAdmin) {
+    $scope.state.formValidationError = '';
+    var error = '';
+    error = FormValidator.validateAccessControl(accessControlData, isAdmin);
+
+    if (error) {
+      $scope.state.formValidationError = error;
+      return false;
+    }
+    return true;
+  }
+
+  $scope.create = function () {
+    confirmCreateContainer()
+    .then(function success(confirm) {
+      if (!confirm) {
+        return false;
+      }
+      $('#createContainerSpinner').show();
+      var accessControlData = $scope.formValues.AccessControlData;
+      var userDetails = Authentication.getUserDetails();
+      var isAdmin = userDetails.role === 1 ? true : false;
+
+      if (!validateForm(accessControlData, isAdmin)) {
+        $('#createContainerSpinner').hide();
+        return;
+      }
+
+      var config = prepareConfiguration();
+      createContainer(config, accessControlData);
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to create container');
+    });
  };
+
+  function createContainer(config, accessControlData) {
+    $q.when(!$scope.formValues.alwaysPull || ImageService.pullImage($scope.config.Image, $scope.formValues.Registry, true))
+    .finally(function final() {
+      ContainerService.createAndStartContainer(config)
+      .then(function success(data) {
+        var containerIdentifier = data.Id;
+        var userId = Authentication.getUserDetails().ID;
+        return ResourceControlService.applyResourceControl('container', containerIdentifier, userId, accessControlData, []);
+      })
+      .then(function success() {
+        Notifications.success('Container successfully created');
+        $state.go('containers', {}, {reload: true});
+      })
+      .catch(function error(err) {
+        Notifications.error('Failure', err, 'Unable to create container');
+      })
+      .finally(function final() {
+        $('#createContainerSpinner').hide();
+      });
+    });
+  }
+
+  initView();
 }]);
@@ -1,7 +1,7 @@
 <rd-header>
  <rd-header-title title="Create container"></rd-header-title>
  <rd-header-content>
-    <a ui-sref="containers">Containers</a> > Add container
+    <a ui-sref="containers">Containers</a> &gt; Add container
  </rd-header-content>
 </rd-header>

@@ -21,34 +21,30 @@
          <div class="col-sm-12 form-section-title">
            Image configuration
          </div>
-          <!-- image-and-registry-inputs -->
-          <div class="form-group">
-            <label for="container_image" class="col-sm-1 control-label text-left">Image</label>
-            <div class="col-sm-11 col-md-6">
-              <input type="text" class="form-control" ng-model="config.Image" id="container_image" placeholder="e.g. ubuntu:trusty">
-            </div>
-            <label for="image_registry" class="col-sm-2 margin-sm-top control-label text-left">
-              Registry
-              <portainer-tooltip position="bottom" message="A registry to pull the image from. Leave empty to use the official Docker registry."></portainer-tooltip>
-            </label>
-            <div class="col-sm-10 col-md-3 margin-sm-top">
-              <input type="text" class="form-control" ng-model="formValues.Registry" id="image_registry" placeholder="e.g. myregistry.mydomain">
-            </div>
+          <div ng-if="!formValues.Registry && fromContainer">
+            <i class="fa fa-exclamation-triangle orange-icon" aria-hidden="true"></i>
+            <span class="small text-danger" style="margin-left: 5px;">The Docker registry for the <code>{{ config.Image }}</code> image is not registered inside Portainer, you will not be able to create a container. Please register that registry first.</span>
          </div>
-          <!-- !image-and-registry-inputs -->
-          <!-- always-pull -->
-          <div class="form-group">
-            <div class="col-sm-12">
-              <label for="ownership" class="control-label text-left">
-                Always pull the image
-                <portainer-tooltip position="bottom" message="When enabled, Portainer will automatically try to pull the specified image before creating the container."></portainer-tooltip>
-              </label>
-              <label class="switch" style="margin-left: 20px;">
-                <input type="checkbox" ng-model="formValues.alwaysPull"><i></i>
-              </label>
+          <div ng-if="formValues.Registry || !fromContainer">
+            <!-- image-and-registry -->
+            <div class="form-group">
+              <por-image-registry image="config.Image" registry="formValues.Registry" ng-if="formValues.Registry"></por-image-registry>
            </div>
+            <!-- !image-and-registry -->
+            <!-- always-pull -->
+            <div class="form-group">
+              <div class="col-sm-12">
+                <label for="ownership" class="control-label text-left">
+                  Always pull the image
+                  <portainer-tooltip position="bottom" message="When enabled, Portainer will automatically try to pull the specified image before creating the container."></portainer-tooltip>
+                </label>
+                <label class="switch" style="margin-left: 20px;">
+                  <input type="checkbox" ng-model="formValues.alwaysPull"><i></i>
+                </label>
+              </div>
+            </div>
+            <!-- !always-pull -->
          </div>
-          <!-- !always-pull -->
          <div class="col-sm-12 form-section-title">
            Ports configuration
          </div>
@@ -107,38 +103,23 @@
            <!-- !port-mapping-input-list -->
          </div>
          <!-- !port-mapping -->
-          <div class="col-sm-12 form-section-title" ng-if="applicationState.application.authentication">
-            Access control
-          </div>
-          <!-- ownership -->
-          <div class="form-group" ng-if="applicationState.application.authentication">
-            <div class="col-sm-12">
-              <label for="ownership" class="control-label text-left">
-                Ownership
-                <portainer-tooltip position="bottom" message="When setting the ownership value to private, only you and the administrators will be able to see and manage this object. When choosing public, everybody will be able to access it."></portainer-tooltip>
-              </label>
-              <div class="btn-group btn-group-sm" style="margin-left: 20px;">
-                <label class="btn btn-primary" ng-model="formValues.Ownership" uib-btn-radio="'private'">
-                  <i class="fa fa-eye-slash" aria-hidden="true"></i>
-                  Private
-                </label>
-                <label class="btn btn-primary" ng-model="formValues.Ownership" uib-btn-radio="'public'">
-                  <i class="fa fa-eye" aria-hidden="true"></i>
-                  Public
-                </label>
-              </div>
-            </div>
-          </div>
-          <!-- !ownership -->
+          <!-- access-control -->
+          <por-access-control-form form-data="formValues.AccessControlData" resource-control="fromContainer.ResourceControl" ng-if="applicationState.application.authentication && fromContainer"></por-access-control-form>
+          <!-- !access-control -->
          <!-- actions -->
          <div class="col-sm-12 form-section-title">
            Actions
          </div>
          <div class="form-group">
            <div class="col-sm-12">
-              <button type="button" class="btn btn-primary btn-sm" ng-disabled="!config.Image" ng-click="create()">Start container</button>
+              <button type="button" class="btn btn-primary btn-sm" ng-disabled="!config.Image || (!formValues.Registry && fromContainer)" ng-click="create()">Start container</button>
              <a type="button" class="btn btn-default btn-sm" ui-sref="containers">Cancel</a>
              <i id="createContainerSpinner" class="fa fa-cog fa-spin" style="margin-left: 5px; display: none;"></i>
+              <span class="text-danger" ng-if="state.formValidationError" style="margin-left: 5px;">{{ state.formValidationError }}</span>
+              <span ng-if="fromContainerMultipleNetworks" style="margin-left: 10px">
+                <i class="fa fa-exclamation-triangle" aria-hidden="true"></i>
+                <span class="small text-muted" style="margin-left: 5px;">This container is connected to multiple networks, only one network will be kept at creation time.</span>
+              </span>
            </div>
          </div>
          <!-- !actions -->
@@ -350,6 +331,22 @@
                </div>
              </div>
              <!-- !domainname -->
+              <!-- ipv4-input -->
+              <div class="form-group">
+                <label for="container_ipv4" class="col-sm-2 col-lg-1 control-label text-left">IPv4 Address</label>
+                <div class="col-sm-9">
+                  <input type="text" class="form-control" ng-model="formValues.IPv4" id="container_ipv4" placeholder="e.g. 172.20.0.7">
+                </div>
+              </div>
+              <!-- !ipv4-input -->
+              <!-- ipv6-input -->
+              <div class="form-group">
+                <label for="container_ipv6" class="col-sm-2 col-lg-1 control-label text-left">IPv6 Address</label>
+                <div class="col-sm-9">
+                  <input type="text" class="form-control" ng-model="formValues.IPv6" id="container_ipv6" placeholder="e.g. a:b:c:d::1234">
+                </div>
+              </div>
+              <!-- !ipv6-input -->
              <!-- extra-hosts-variables -->
              <div class="form-group">
                <div class="col-sm-12" style="margin-top: 5px;">
@@ -485,6 +482,36 @@
              </div>
              <!-- !privileged-mode -->
            </form>
+            <form class="form-horizontal" style="margin-top: 15px;">
+              <!-- devices -->
+              <div class="form-group">
+                <div class="col-sm-12" style="margin-top: 5px;">
+                  <label class="control-label text-left">Devices</label>
+                  <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addDevice()">
+                    <i class="fa fa-plus-circle" aria-hidden="true"></i> add device
+                  </span>
+                </div>
+               <!-- devices-input-list -->
+                <div class="col-sm-12 form-inline" style="margin-top: 10px;">
+                  <div ng-repeat="device in config.HostConfig.Devices" style="margin-top: 2px;">
+                    <div class="input-group col-sm-5 input-group-sm">
+                      <span class="input-group-addon">host</span>
+                      <input type="text" class="form-control" ng-model="device.pathOnHost" placeholder="e.g. /dev/tty0">
+                    </div>
+                    <div class="input-group col-sm-5 input-group-sm">
+                      <span class="input-group-addon">container</span>
+                      <input type="text" class="form-control" ng-model="device.pathInContainer" placeholder="e.g. /dev/tty0">
+                    </div>
+                    <button class="btn btn-sm btn-danger" type="button" ng-click="removeDevice($index)">
+                      <i class="fa fa-trash" aria-hidden="true"></i>
+                    </button>
+                  </div>
+                </div>
+                <!-- !devices-input-list -->
+              </div>
+              <!-- !devices-->
+            </form>
+
          </div>
          <!-- !tab-runtime -->
        </div>
@@ -1,13 +1,21 @@
 angular.module('createNetwork', [])
-.controller('CreateNetworkController', ['$scope', '$state', 'Messages', 'Network',
-function ($scope, $state, Messages, Network) {
+.controller('CreateNetworkController', ['$q', '$scope', '$state', 'PluginService', 'Notifications', 'NetworkService', 'LabelHelper', 'Authentication', 'ResourceControlService', 'FormValidator',
+function ($q, $scope, $state, PluginService, Notifications, NetworkService, LabelHelper, Authentication, ResourceControlService, FormValidator) {
+
  $scope.formValues = {
    DriverOptions: [],
    Subnet: '',
    Gateway: '',
-    Labels: []
+    Labels: [],
+    AccessControlData: new AccessControlFormData()
  };

+  $scope.state = {
+    formValidationError: ''
+  };
+
+  $scope.availableNetworkDrivers = [];
+
  $scope.config = {
    Driver: 'bridge',
    CheckDuplicate: true,
@@ -30,30 +38,13 @@ function ($scope, $state, Messages, Network) {
  };

  $scope.addLabel = function() {
-    $scope.formValues.Labels.push({ name: '', value: ''});
+    $scope.formValues.Labels.push({ key: '', value: ''});
  };

  $scope.removeLabel = function(index) {
    $scope.formValues.Labels.splice(index, 1);
  };

-  function createNetwork(config) {
-    $('#createNetworkSpinner').show();
-    Network.create(config, function (d) {
-      if (d.message) {
-        $('#createNetworkSpinner').hide();
-        Messages.error('Unable to create network', {}, d.message);
-      } else {
-        Messages.send("Network created", d.Id);
-        $('#createNetworkSpinner').hide();
-        $state.go('networks', {}, {reload: true});
-      }
-    }, function (e) {
-      $('#createNetworkSpinner').hide();
-      Messages.error("Failure", e, 'Unable to create network');
-    });
-  }
-
  function prepareIPAMConfiguration(config) {
    if ($scope.formValues.Subnet) {
      var ipamConfig = {};
@@ -74,13 +65,7 @@ function ($scope, $state, Messages, Network) {
  }

  function prepareLabelsConfig(config) {
-    var labels = {};
-    $scope.formValues.Labels.forEach(function (label) {
-      if (label.name && label.value) {
-          labels[label.name] = label.value;
-      }
-    });
-    config.Labels = labels;
+    config.Labels = LabelHelper.fromKeyValueToLabelHash($scope.formValues.Labels);
  }

  function prepareConfiguration() {
@@ -91,8 +76,66 @@ function ($scope, $state, Messages, Network) {
    return config;
  }

+  function validateForm(accessControlData, isAdmin) {
+    $scope.state.formValidationError = '';
+    var error = '';
+    error = FormValidator.validateAccessControl(accessControlData, isAdmin);
+
+    if (error) {
+      $scope.state.formValidationError = error;
+      return false;
+    }
+    return true;
+  }
+
  $scope.create = function () {
-    var config = prepareConfiguration();
-    createNetwork(config);
+    $('#createResourceSpinner').show();
+
+    var networkConfiguration = prepareConfiguration();
+    var accessControlData = $scope.formValues.AccessControlData;
+    var userDetails = Authentication.getUserDetails();
+    var isAdmin = userDetails.role === 1 ? true : false;
+
+    if (!validateForm(accessControlData, isAdmin)) {
+      $('#createResourceSpinner').hide();
+      return;
+    }
+
+    NetworkService.create(networkConfiguration)
+    .then(function success(data) {
+      var networkIdentifier = data.Id;
+      var userId = userDetails.ID;
+      return ResourceControlService.applyResourceControl('network', networkIdentifier, userId, accessControlData, []);
+    })
+    .then(function success() {
+      Notifications.success('Network successfully created');
+      $state.go('networks', {}, {reload: true});
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'An error occured during network creation');
+    })
+    .finally(function final() {
+      $('#createResourceSpinner').hide();
+    });
  };
+
+  function initView() {
+    $('#loadingViewSpinner').show();
+    var endpointProvider = $scope.applicationState.endpoint.mode.provider;
+    var apiVersion = $scope.applicationState.endpoint.apiVersion;
+    if(endpointProvider !== 'DOCKER_SWARM') {
+      PluginService.networkPlugins(apiVersion < 1.25)
+      .then(function success(data){
+          $scope.availableNetworkDrivers = data;
+      })
+      .catch(function error(err) {
+        Notifications.error('Failure', err, 'Unable to retrieve network drivers');
+      })
+      .finally(function final() {
+        $('#loadingViewSpinner').hide();
+      });
+    }
+  }
+
+  initView();
 }]);
@@ -1,7 +1,9 @@
 <rd-header>
-  <rd-header-title title="Create network"></rd-header-title>
+  <rd-header-title title="Create network">
+    <i id="loadingViewSpinner" class="fa fa-cog fa-spin"></i>
+  </rd-header-title>
  <rd-header-content>
-    <a ui-sref="networks">Networks</a> > Add network
+    <a ui-sref="networks">Networks</a> &gt; Add network
  </rd-header-content>
 </rd-header>

@@ -39,8 +41,11 @@
          <!-- driver-input -->
          <div class="form-group">
            <label for="network_driver" class="col-sm-2 col-lg-1 control-label text-left">Driver</label>
-            <div class="col-sm-10">
-              <input type="text" class="form-control" ng-model="config.Driver" id="network_driver" placeholder="e.g. driverName">
+            <div class="col-sm-11">
+              <select class="form-control" ng-options="driver for driver in availableNetworkDrivers" ng-model="config.Driver" ng-if="availableNetworkDrivers.length > 0">
+                <option disabled hidden value="">Select a driver</option>
+              </select>
+              <input type="text" class="form-control" ng-model="config.Driver" id="network_driver" placeholder="e.g. driverName" ng-if="availableNetworkDrivers.length === 0">
            </div>
          </div>
          <!-- !driver-input -->
@@ -90,7 +95,7 @@
              <div ng-repeat="label in formValues.Labels" style="margin-top: 2px;">
                <div class="input-group col-sm-5 input-group-sm">
                  <span class="input-group-addon">name</span>
-                  <input type="text" class="form-control" ng-model="label.name" placeholder="e.g. com.example.foo">
+                  <input type="text" class="form-control" ng-model="label.key" placeholder="e.g. com.example.foo">
                </div>
                <div class="input-group col-sm-5 input-group-sm">
                  <span class="input-group-addon">value</span>
@@ -116,6 +121,9 @@
            </div>
          </div>
          <!-- !internal -->
+          <!-- access-control -->
+          <por-access-control-form form-data="formValues.AccessControlData" ng-if="applicationState.application.authentication"></por-access-control-form>
+          <!-- !access-control -->
          <!-- actions -->
          <div class="col-sm-12 form-section-title">
            Actions
@@ -124,7 +132,8 @@
            <div class="col-sm-12">
              <button type="button" class="btn btn-primary btn-sm" ng-disabled="!config.Name" ng-click="create()">Create network</button>
              <a type="button" class="btn btn-default btn-sm" ui-sref="networks">Cancel</a>
-              <i id="createNetworkSpinner" class="fa fa-cog fa-spin" style="margin-left: 5px; display: none;"></i>
+              <i id="createResourceSpinner" class="fa fa-cog fa-spin" style="margin-left: 5px; display: none;"></i>
+              <span class="text-danger" ng-if="state.formValidationError" style="margin-left: 5px;">{{ state.formValidationError }}</span>
            </div>
          </div>
          <!-- !actions -->
--- a/Show More
+++ b/Show More